{"id":"RUSTSEC-2026-0180","aliases":["GHSA-rgqc-3x5p-6gwg"],"title":"Panic decoding a malformed `hstore` value allows denial of service","summary":"Panic decoding a malformed `hstore` value allows denial of service","severity":"none","vendor":"postgres-protocol","product":"postgres-protocol","ecosystem":"rust","affected":["postgres-protocol >= 0.0.0-0, < 0.6.12"],"patched":["postgres-protocol 0.6.12"],"published":"2026-06-12","updated":"2026-08-25","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0180","references":[{"url":"https://crates.io/crates/postgres-protocol"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0180.html"},{"url":"https://github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d"}],"tags":["osv","rust"],"ingestedAt":"2026-08-25T19:26:23.635Z","slug":"RUSTSEC-2026-0180","body":"## Overview\n\nA malicious or compromised server can return a binary `hstore` value with an\ninvalid internal length field, causing the client to panic while decoding it.\n\nApplications that connect only to a trusted database are not exposed; the risk\napplies to clients that may connect to untrusted or user-supplied servers, or\nwhose connection can be intercepted by a man-in-the-middle.\n\n## Affected packages\n\n- `postgres-protocol >= 0.0.0-0, < 0.6.12`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `postgres-protocol 0.6.12`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}