Rust advisories / tokio-postgres
Vulnerability MediumRUSTSEC-2026-0178 · tokio-postgres
RUSTSEC-2026-0178: Panic on a `DataRow` with fewer fields than columns allows denial of service
Short answerA security vulnerability in the tokio-postgres crate: Panic on a `DataRow` with fewer fields than columns allows denial of service. GitHub rates it Medium. Fixed in 0.7.18: update to a fixed version.
| Crate | tokio-postgres |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | From 0.4.0 before 0.7.18. |
| Fixed in | 0.7.18 |
| Severity | Medium (GitHub rating) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| Published | 2026-06-12 |
| Last changed | 2026-08-25 |
| Also known as | GHSA-3gjw-f78c-vvpw |
| Affected functions | tokio_postgres::Row::get, tokio_postgres::Row::try_get, tokio_postgres::SimpleQueryRow::get, tokio_postgres::SimpleQueryRow::try_get |
What to do
- See which version you have:
cargo tree -i tokio-postgres(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p tokio-postgres. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampletokio-postgres = "0.7.18") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking try_get, and both Row and SimpleQueryRow.
Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
References
- Package: crates.io/crates/tokio-postgres
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0178.html
- Web: github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?