RUSTSEC-2026-0178

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0178

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0178.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0178

Published

2026-06-12T12:00:00Z

Modified

2026-06-12T17:30:03.619126792Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Panic on a `DataRow` with fewer fields than columns allows denial of service

Details

A malicious or compromised server can send a row containing fewer fields than its row description declares columns. Reading one of the missing columns then panics with an out-of-bounds index, aborting the calling task. This affects even the otherwise non-panicking try_get, and both Row and SimpleQueryRow.

Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / tokio-postgres

Package

Name: tokio-postgres; View open source insights on deps.dev
Purl: pkg:cargo/tokio-postgres

Affected ranges

Type: SEMVER
Events: Introduced

0.4.0

Fixed

0.7.18

Ecosystem specific

{
    "affects": {
        "arch": [],
        "functions": [
            "tokio_postgres::Row::get",
            "tokio_postgres::Row::try_get",
            "tokio_postgres::SimpleQueryRow::get",
            "tokio_postgres::SimpleQueryRow::try_get"
        ],
        "os": []
    },
    "affected_functions": null
}