RUSTSEC-2026-0179: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

What to do

1. See which version you have: cargo tree -i postgres-protocol (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p postgres-protocol. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example postgres-protocol = "0.6.12") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a tokio worker thread for minutes per connection, possibly stalling the whole async runtime.

Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.

References

• Package: crates.io/crates/postgres-protocol
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0179.html
• Web: github.com/rust-postgres/rust-postgres/commit/d40097a36a85068ea50a3afbf0ce154ba439e7f0
• Advisory: github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for postgres-protocol

• VulnerabilityRUSTSEC-2026-0180 · 2026-06-12Panic decoding a malformed `hstore` value allows denial of service

Full security history of postgres-protocol