GHSA-rgqc-3x5p-6gwg

Summary

postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service

Severity

medium

CWE

CWE-20, CWE-248

Published

2026-08-24

Updated

2026-08-24

Advisory details

A malicious or compromised server can return a binary hstore value with an invalid internal length field, causing the client to panic while decoding it.

Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.

References

• https://github.com/advisories/GHSA-rgqc-3x5p-6gwg
• https://github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d
• https://github.com/rust-postgres/rust-postgres/releases/tag/postgres-protocol-v0.6.12
• https://rustsec.org/advisories/RUSTSEC-2026-0180.html

Related advisories

• CVE-2026-52856 — high · Go/github.com/pterodactyl/wings
• CVE-2026-100347 — medium · Go/github.com/getkin/kin-openapi
• CVE-2026-105757 — medium · PyPI/vllm
• CVE-2026-105756 — medium · PyPI/vllm
• CVE-2026-54529 — medium · PyPI/sqladmin
• CVE-2026-65834 — medium · Go/github.com/projectcapsule/capsule
• CVE-2026-14631 — medium · npm/webpack-dev-server
• GHSA-c8w6-x74f-vmg3#zebrad — medium · crates.io/zebrad

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity