{"id":"RUSTSEC-2026-0178","summary":"Panic on a `DataRow` with fewer fields than columns allows denial of service","details":"A malicious or compromised server can send a row containing fewer fields than\nits row description declares columns. Reading one of the missing columns then\npanics with an out-of-bounds index, aborting the calling task. This affects even\nthe otherwise non-panicking `try_get`, and both `Row` and `SimpleQueryRow`.\n\nApplications that connect only to a trusted database are not exposed; the risk\napplies to clients that may connect to untrusted or user-supplied servers, or\nwhose connection can be intercepted by a man-in-the-middle.","aliases":["GHSA-3gjw-f78c-vvpw"],"modified":"2026-08-25T02:45:03.437011884Z","published":"2026-06-12T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/tokio-postgres"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0178.html"},{"type":"WEB","url":"https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1"}],"affected":[{"package":{"name":"tokio-postgres","ecosystem":"crates.io","purl":"pkg:cargo/tokio-postgres"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.0"},{"fixed":"0.7.18"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":["tokio_postgres::Row::get","tokio_postgres::Row::try_get","tokio_postgres::SimpleQueryRow::get","tokio_postgres::SimpleQueryRow::try_get"],"arch":[]},"affected_functions":null},"database_specific":{"categories":["denial-of-service"],"cvss":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0178.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}