{"id":"GHSA-rgqc-3x5p-6gwg","title":"postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service","summary":"postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service","severity":"medium","cwe":["CWE-20","CWE-248"],"vendor":"postgres-protocol","product":"postgres-protocol","ecosystem":"rust","affected":["postgres-protocol < 0.6.12"],"patched":["postgres-protocol 0.6.12"],"published":"2026-08-24","updated":"2026-08-24","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-rgqc-3x5p-6gwg","references":[{"url":"https://github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d"},{"url":"https://github.com/rust-postgres/rust-postgres/releases/tag/postgres-protocol-v0.6.12"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0180.html"},{"url":"https://github.com/advisories/GHSA-rgqc-3x5p-6gwg"}],"tags":["ghsa","rust"],"ingestedAt":"2026-08-24T20:10:47.198Z","slug":"GHSA-rgqc-3x5p-6gwg","body":"## Overview\n\nA malicious or compromised server can return a binary `hstore` value with an\ninvalid internal length field, causing the client to panic while decoding it.\n\nApplications that connect only to a trusted database are not exposed; the risk\napplies to clients that may connect to untrusted or user-supplied servers, or\nwhose connection can be intercepted by a man-in-the-middle.\n\n## Affected packages\n\n- `postgres-protocol < 0.6.12`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `postgres-protocol 0.6.12`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}