Summary
postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service
Advisory details
A malicious or compromised server can return a binary hstore value with an
invalid internal length field, causing the client to panic while decoding it.
Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-65834
Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests
- HIGHCVE-2026-52856
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
- MEDIUMCVE-2026-14631
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
- HIGHCVE-2026-75975
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- MEDIUMCVE-2026-18504
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
- MEDIUMCVE-2026-73845
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)