Executive brief
The postgres-protocol Rust library, used by applications to communicate with PostgreSQL databases, contains a vulnerability where a malicious or compromised server can send a specially crafted hstore (key-value data type) value that causes the client to crash. This crash can be triggered by anyone connecting to an untrusted database or when a database connection is intercepted, resulting in denial of service and application unavailability.
Technical details
The vulnerability exists in the hstore decoder (hstore_from_sql function) where the HstoreEntries::next method reads a server-supplied length value for hstore keys and values without validation. It then calls the panicking slice::split_at method without checking if the declared length exceeds the remaining buffer bytes, allowing an attacker to trigger an out-of-bounds panic. The fix replaces split_at with split_at_checked and returns an error instead of panicking, matching the behavior of array and range decoders. The attack requires the ability to control server responses (malicious/compromised server or MITM position) but no privileges or user interaction. Patched version 0.6.12 and later are available.
Affected products
- rust-postgres postgres-protocol < 0.6.12
Timeline
- 2026-06-12: disclosed: Vulnerability reported and patched
- 2026-06-12: patched: Fix released in postgres-protocol v0.6.12
- 2026-08-24: advisory: GHSA advisory published