RUSTSEC-2026-0179

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0179

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0179.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0179

Published

2026-06-12T12:00:00Z

Modified

2026-06-12T17:30:03.598573117Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

Details

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a tokio worker thread for minutes per connection, possibly stalling the whole async runtime.

Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / postgres-protocol

Package

Name: postgres-protocol; View open source insights on deps.dev
Purl: pkg:cargo/postgres-protocol

Affected ranges

Type: SEMVER
Events: Introduced

0.3.0

Fixed

0.6.12

Ecosystem specific

{
    "affects": {
        "arch": [],
        "functions": [
            "postgres_protocol::authentication::sasl::ScramSha256::update"
        ],
        "os": []
    },
    "affected_functions": null
}