Executive brief
tokio-postgres is a Rust library for connecting to PostgreSQL databases. A malicious or compromised database server can trigger a crash in applications using this library by sending a specially crafted data row with fewer fields than expected, causing the client application to abort. This affects applications that connect to untrusted databases or whose connection could be intercepted by an attacker.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in tokio-postgres versions 0.4.0 through 0.7.17. When a PostgreSQL server sends a DataRow message with fewer fields than the corresponding row description declares, accessing any of the missing columns via the Row::get or Row::try_get methods (and similarly for SimpleQueryRow) triggers an index out-of-bounds panic that aborts the async task. The attack requires network access to the database connection and does not require authentication or user interaction. Applications connecting only to trusted, internally-managed databases are not exposed; risk applies to clients connecting to user-supplied or untrusted servers, or whose connections can be intercepted by a man-in-the-middle. The fix, available in version 0.7.18, rejects DataRow messages with field counts that differ from the column description rather than panicking.
Affected products
- Rust postgres project tokio-postgres 0.4.0 to 0.7.17
Timeline
- 2026-06-12: disclosed: Vulnerability reported
- 2026-06-12: patched: Fix released in tokio-postgres 0.7.18
- 2026-08-24: advisory: GitHub Advisory GHSA-3gjw-f78c-vvpw published