GHSA-3GJW-F78C-VVPW: Denial of Service via Unhandled Out-of-Bounds Indexing Panic in tokio-postgres
Vulnerability ID: GHSA-3GJW-F78C-VVPW
CVSS Score: 7.5
Published: 2026-08-24
An issue was discovered in the tokio-postgres library for Rust prior to version 0.7.18. A trust assumption mismatch between the PostgreSQL protocol messages sent by a server and how they are parsed and indexed by the client-side library allows a rogue or compromised database server to trigger a Denial of Service (DoS) crash via an unhandled out-of-bounds slice indexing panic.
TL;DR
Unvalidated DataRow field counts in tokio-postgres allow a rogue or compromised database server to crash client applications via an out-of-bounds panic.
Technical Details
- CWE ID: CWE-129
- Attack Vector: Network / Man-in-the-Middle / Malicious Database Connection
- CVSS Score: 7.5 (Qualitative Assessment)
- EPSS Score: N/A (No CVE Assigned)
- Impact: Denial of Service (DoS)
- Exploit Status: none
- KEV Status: Not Listed
Affected Systems
- tokio-postgres library client applications
-
tokio-postgres: < 0.7.18 (Fixed in:
0.7.18)
Code Analysis
Commit: 7a00ffa
Fix out-of-bounds indexing panic by validating DataRow field count during row constructor execution
Mitigation Strategies
- Upgrade tokio-postgres dependency to version 0.7.18 or higher.
- Enable strict TLS hostname and certificate validation for all PostgreSQL database connections.
- Implement strict ingress/egress validation to prevent unauthorized connections to arbitrary user-controlled database hosts.
Remediation Steps:
- Identify vulnerable dependencies using
cargo tree -p tokio-postgresor scanning tools. - Update Cargo.toml to define
tokio-postgres = "0.7.18". - Execute
cargo update -p tokio-postgresto download and lock the secured version. - Review and enable TLS settings (
sslmode=verify-fullor equivalent) across database connectors.
References
Read the full report for GHSA-3GJW-F78C-VVPW on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)