{"id":"GHSA-3gjw-f78c-vvpw","aliases":["RUSTSEC-2026-0178"],"url":"https://o3.security/vulnerability/GHSA-3gjw-f78c-vvpw","summary":"tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of service","details":"A malicious or compromised server can send a row containing fewer fields than\nits row description declares columns. Reading one of the missing columns then\npanics with an out-of-bounds index, aborting the calling task. This affects even\nthe otherwise non-panicking `try_get`, and both `Row` and `SimpleQueryRow`.\n\nApplications that connect only to a trusted database are not exposed; the risk\napplies to clients that may connect to untrusted or user-supplied servers, or\nwhose connection can be intercepted by a man-in-the-middle.","published":"2026-08-24T19:49:17Z","modified":"2026-08-25T02:55:59.557390596Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"tokio-postgres","fixedVersion":"0.7.18"}],"fix":{"url":"https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1","label":"rust-postgres/rust-postgres@7a00ffa"},"references":[{"type":"WEB","url":"https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1"},{"type":"PACKAGE","url":"https://github.com/rust-postgres/rust-postgres"},{"type":"WEB","url":"https://github.com/rust-postgres/rust-postgres/releases/tag/tokio-postgres-v0.7.18"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0178.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-25T02:55:59.557390596Z"}}