---
id: RUSTSEC-2026-0178
aliases:
  - GHSA-3gjw-f78c-vvpw
title: Panic on a `DataRow` with fewer fields than columns allows denial of service
summary: Panic on a `DataRow` with fewer fields than columns allows denial of service
severity: none
vendor: tokio-postgres
product: tokio-postgres
ecosystem: rust
affected:
  - 'tokio-postgres >= 0.4.0, < 0.7.18'
patched:
  - tokio-postgres 0.7.18
published: '2026-06-12'
updated: '2026-08-25'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0178'
references:
  - url: 'https://crates.io/crates/tokio-postgres'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0178.html'
  - url: >-
      https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1
tags:
  - osv
  - rust
ingestedAt: '2026-08-25T19:26:23.560Z'
---

## Overview

A malicious or compromised server can send a row containing fewer fields than
its row description declares columns. Reading one of the missing columns then
panics with an out-of-bounds index, aborting the calling task. This affects even
the otherwise non-panicking `try_get`, and both `Row` and `SimpleQueryRow`.

Applications that connect only to a trusted database are not exposed; the risk
applies to clients that may connect to untrusted or user-supplied servers, or
whose connection can be intercepted by a man-in-the-middle.

## Affected packages

- `tokio-postgres >= 0.4.0, < 0.7.18`

## Remediation

Upgrade to a patched release:

- `tokio-postgres 0.7.18`