postgres-protocol unbounded SCRAM iteration count DoS

Severity: high · CVSS 8.7 · Published 2026-08-24

The postgres-protocol Rust library is used by applications to authenticate with PostgreSQL databases. A malicious or compromised server can force a client to perform billions of cryptographic operations during connection, consuming CPU resources and potentially freezing the entire application's async runtime for minutes. This affects applications connecting to untrusted databases or those vulnerable to network interception.

Technologies: postgres-protocol (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.7, published 24 August 2026.
Which products and versions are affected?
postgres-protocol (crates.io) >= 0.3.0, < 0.6.12.
Is there a fix for This vulnerability?
A patch was published on 2026-06-12: postgres-protocol v0.6.12 released with iteration count cap at 100,000 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run postgres-protocol (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the SCRAM-SHA-256 authentication handshake implementation within postgres-protocol's sasl.rs module. The PBKDF2 iteration count is server-controlled and sent in the server-first message; prior to the patch, this value was passed unbounded to the PBKDF2 key derivation function, allowing a malicious server to specify an extremely large value (up to 4,294,967,295) and force the client to execute billions of HMAC-SHA256 operations synchronously on the connection thread. Attack vector is network-based with no authentication or user interaction required; any client connecting to an untrusted server or whose connection can be intercepted is exposed. The fix (released in postgres-protocol v0.6.12) caps the iteration count at 100,000, approximately 24× PostgreSQL's default of 4,096, matching the same defensive measure adopted by the pgjdbc driver for CVE-2026-42198.

Affected products

  • rust-postgres postgres-protocol >= 0.3.0, < 0.6.12

Timeline

  • 2026-06-12: reported: Vulnerability reported
  • 2026-06-12: patched: postgres-protocol v0.6.12 released with iteration count cap at 100,000
  • 2026-08-24: advisory: GHSA-5x78-73v4-xg6w published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.