{"id":"GHSA-5x78-73v4-xg6w","title":"postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service","summary":"postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service","severity":"high","cwe":["CWE-770"],"vendor":"postgres-protocol","product":"postgres-protocol","ecosystem":"rust","affected":["postgres-protocol >= 0.3.0, < 0.6.12"],"patched":["postgres-protocol 0.6.12"],"published":"2026-08-24","updated":"2026-08-24","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-5x78-73v4-xg6w","references":[{"url":"https://github.com/rust-postgres/rust-postgres/commit/d40097a36a85068ea50a3afbf0ce154ba439e7f0"},{"url":"https://github.com/rust-postgres/rust-postgres/releases/tag/postgres-protocol-v0.6.12"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0179.html"},{"url":"https://github.com/advisories/GHSA-5x78-73v4-xg6w"}],"tags":["ghsa","rust"],"ingestedAt":"2026-08-24T20:10:47.235Z","slug":"GHSA-5x78-73v4-xg6w","body":"## Overview\n\nA malicious, compromised, or man-in-the-middle server can supply an arbitrarily\nlarge SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client\nruns it inline with no upper bound, pinning a `tokio` worker thread for minutes\nper connection, possibly stalling the whole async runtime.\n\nApplications that connect only to a trusted database are not exposed; the risk\napplies to clients that may connect to untrusted or user-supplied servers, or\nwhose connection can be intercepted by a man-in-the-middle.\n\n## Affected packages\n\n- `postgres-protocol >= 0.3.0, < 0.6.12`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `postgres-protocol 0.6.12`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}