{"id":"GHSA-3gjw-f78c-vvpw","title":"tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service","summary":"tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service","severity":"medium","cwe":["CWE-125"],"vendor":"tokio-postgres","product":"tokio-postgres","ecosystem":"rust","affected":["tokio-postgres >= 0.4.0, < 0.7.18"],"patched":["tokio-postgres 0.7.18"],"published":"2026-08-24","updated":"2026-08-24","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-3gjw-f78c-vvpw","references":[{"url":"https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1"},{"url":"https://github.com/rust-postgres/rust-postgres/releases/tag/tokio-postgres-v0.7.18"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0178.html"},{"url":"https://github.com/advisories/GHSA-3gjw-f78c-vvpw"}],"tags":["ghsa","rust"],"ingestedAt":"2026-08-24T20:10:47.161Z","slug":"GHSA-3gjw-f78c-vvpw","body":"## Overview\n\nA malicious or compromised server can send a row containing fewer fields than\nits row description declares columns. Reading one of the missing columns then\npanics with an out-of-bounds index, aborting the calling task. This affects even\nthe otherwise non-panicking `try_get`, and both `Row` and `SimpleQueryRow`.\n\nApplications that connect only to a trusted database are not exposed; the risk\napplies to clients that may connect to untrusted or user-supplied servers, or\nwhose connection can be intercepted by a man-in-the-middle.\n\n## Affected packages\n\n- `tokio-postgres >= 0.4.0, < 0.7.18`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tokio-postgres 0.7.18`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}