Rust advisories / postgres-protocol
Vulnerability MediumRUSTSEC-2026-0180 · postgres-protocol
RUSTSEC-2026-0180: Panic decoding a malformed `hstore` value allows denial of service
Short answerA security vulnerability in the postgres-protocol crate: Panic decoding a malformed `hstore` value allows denial of service. GitHub rates it Medium. Fixed in 0.6.12: update to a fixed version.
| Crate | postgres-protocol |
|---|---|
| Type | Vulnerability (denial-of-service) |
| Affected versions | Before 0.6.12. |
| Fixed in | 0.6.12 |
| Severity | Medium (GitHub rating) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| Published | 2026-06-12 |
| Last changed | 2026-08-25 |
| Also known as | GHSA-rgqc-3x5p-6gwg |
| Affected functions | postgres_protocol::types::hstore_from_sql |
What to do
- See which version you have:
cargo tree -i postgres-protocol(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p postgres-protocol. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplepostgres-protocol = "0.6.12") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
A malicious or compromised server can return a binary hstore value with an invalid internal length field, causing the client to panic while decoding it.
Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
References
- Package: crates.io/crates/postgres-protocol
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0180.html
- Web: github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for postgres-protocol
Up next
Same cratepostgres-protocol: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?