# postgres-protocol panic on malformed hstore value

Source: https://junglewise.ai/threats/postgres-protocol-panic-on-malformed-hstore-value-98d63cdf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.9 · Published 2026-08-24

The postgres-protocol Rust library, used by applications to communicate with PostgreSQL databases, contains a vulnerability where a malicious or compromised server can send a specially crafted hstore (key-value data type) value that causes the client to crash. This crash can be triggered by anyone connecting to an untrusted database or when a database connection is intercepted, resulting in denial of service and application unavailability.

Technologies: [postgres-protocol (crates.io)](https://junglewise.ai/threats/technologies/postgres-protocol). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Unknown](https://junglewise.ai/threats/vendors/unknown).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.9, published 24 August 2026.

**Which products and versions are affected?** postgres-protocol (crates.io) < 0.6.12; Unknown Rust-Postgres < 0.6.12.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-12: Fix released in postgres-protocol v0.6.12 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run postgres-protocol (crates.io) or Unknown Rust-Postgres at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the hstore decoder (hstore_from_sql function) where the HstoreEntries::next method reads a server-supplied length value for hstore keys and values without validation. It then calls the panicking slice::split_at method without checking if the declared length exceeds the remaining buffer bytes, allowing an attacker to trigger an out-of-bounds panic. The fix replaces split_at with split_at_checked and returns an error instead of panicking, matching the behavior of array and range decoders. The attack requires the ability to control server responses (malicious/compromised server or MITM position) but no privileges or user interaction. Patched version 0.6.12 and later are available.

## Affected products

- rust-postgres postgres-protocol < 0.6.12

## Timeline

- 2026-06-12: disclosed: Vulnerability reported and patched
- 2026-06-12: patched: Fix released in postgres-protocol v0.6.12
- 2026-08-24: advisory: GHSA advisory published

## References

- [https://github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d](https://github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d)
- [https://github.com/rust-postgres/rust-postgres/releases/tag/postgres-protocol-v0.6.12](https://github.com/rust-postgres/rust-postgres/releases/tag/postgres-protocol-v0.6.12)
- [https://rustsec.org/advisories/RUSTSEC-2026-0180.html](https://rustsec.org/advisories/RUSTSEC-2026-0180.html)

## Related threats

- [postgres-protocol unbounded SCRAM iteration count DoS](https://junglewise.ai/threats/postgres-protocol-unbounded-scram-iteration-count-dos-d8dcba22)
- [RUSTSEC-2026-0180 - Panic decoding a malformed `hstore` value allows denial of service](https://junglewise.ai/threats/rustsec-2026-0180-panic-decoding-a-malformed-hstore-value-allows-denial-cd67b06d)
- [RUSTSEC-2026-0179 - Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service](https://junglewise.ai/threats/rustsec-2026-0179-unbounded-scram-iteration-count-allows-a-malicious-d5d33560)