{"id":"RUSTSEC-2026-0179","aliases":["GHSA-5x78-73v4-xg6w"],"title":"Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service","summary":"Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service","severity":"none","vendor":"postgres-protocol","product":"postgres-protocol","ecosystem":"rust","affected":["postgres-protocol >= 0.3.0, < 0.6.12"],"patched":["postgres-protocol 0.6.12"],"published":"2026-06-12","updated":"2026-08-25","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0179","references":[{"url":"https://crates.io/crates/postgres-protocol"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0179.html"},{"url":"https://github.com/rust-postgres/rust-postgres/commit/d40097a36a85068ea50a3afbf0ce154ba439e7f0"},{"url":"https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-98qh-xjc8-98pq"}],"tags":["osv","rust"],"ingestedAt":"2026-08-25T19:26:23.597Z","slug":"RUSTSEC-2026-0179","body":"## Overview\n\nA malicious, compromised, or man-in-the-middle server can supply an arbitrarily\nlarge SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client\nruns it inline with no upper bound, pinning a `tokio` worker thread for minutes\nper connection, possibly stalling the whole async runtime.\n\nApplications that connect only to a trusted database are not exposed; the risk\napplies to clients that may connect to untrusted or user-supplied servers, or\nwhose connection can be intercepted by a man-in-the-middle.\n\n## Affected packages\n\n- `postgres-protocol >= 0.3.0, < 0.6.12`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `postgres-protocol 0.6.12`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}