GHSA-5x78-73v4-xg6w: postgres-protocol Denial of Service Vulnerability

HIGH
Share
CWE-770
Published
Advisory Summary

GHSA-5x78-73v4-xg6w is a HIGH denial of service vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) affecting postgres-protocol libraries in the crates.io ecosystem. The issue involves unbounded scram iteration count allows a malicious server to cause cpu-exhaustion denial of service. Remediation is available by upgrading affected packages to version 0.6.12.

GHSA-5x78-73v4-xg6w at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-5x78-73v4-xg6w
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-770: Allocation of Resources Without Limits or Throttling
Affected Product postgres-protocol
Package Ecosystem crates.io
Published Date
Last Updated

How to Fix GHSA-5x78-73v4-xg6w

To remediate this vulnerability, upgrade all affected postgres-protocol dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

postgres-protocol fixed: 0.6.12 
Upgrade postgres-protocol to 0.6.12
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for postgres-protocol

How to Check if You Are Affected

To determine whether your application is affected by GHSA-5x78-73v4-xg6w, inspect your project dependencies for postgres-protocol:

inspect dependencies for postgres-protocol

Analyze the terminal output to locate any version of postgres-protocol in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.6.12), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling, where the product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. In postgres-protocol, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs it inline with no upper bound, pinning a `tokio` worker thread for minutes per connection, possibly stalling the whole async runtime. Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.

GHSA-5x78-73v4-xg6w Affected postgres-protocol Versions

1 component(s)
Fixed Versions:
0.6.12
Product / Package Ecosystem Affected Versions Fixed Version
postgres-protocol
 crates.io
≥ 0.3.0
< 0.6.12
0.6.12

References

Security Fix Commit FIX COMMIT
https://github.com/rust-postgres/rust-postgres/commit/d40097a36a85068ea50a3afbf0ce154ba439e7f0
postgres-protocol Source Repository REPOSITORY
https://github.com/rust-postgres/rust-postgres
postgres-protocol Release RELEASE
https://github.com/rust-postgres/rust-postgres/releases/tag/postgres-protocol-v0.6.12
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2026-0179.html

Frequently Asked Questions

What is GHSA-5x78-73v4-xg6w?
GHSA-5x78-73v4-xg6w is a security vulnerability in postgres-protocol involving Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service under CWE-770: Allocation of Resources Without Limits or Throttling.
Which postgres-protocol versions are affected?
Affected versions include releases prior to 0.6.12 across affected packages: postgres-protocol.
What version fixes GHSA-5x78-73v4-xg6w?
Upgrading to 0.6.12 (or the latest patched release for your respective branch) resolves the vulnerability.
Is postgres-protocol affected?
Yes, postgres-protocol is affected in releases prior to 0.6.12. Upgrade your dependency to 0.6.12 or later.
What CWE is associated with GHSA-5x78-73v4-xg6w?
GHSA-5x78-73v4-xg6w is classified under CWE-770: Allocation of Resources Without Limits or Throttling (The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.).
How can I check crates.io dependencies for GHSA-5x78-73v4-xg6w?
Run the dependency tree command: 'inspect dependencies for postgres-protocol'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5x78-73v4-xg6w",
  "modified" : "2026-08-24T19:43:32Z",
  "published" : "2026-08-24T19:43:31Z",
  "aliases" : [ ],
  "summary" : "postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service",
  "details" : "A malicious, compromised, or man-in-the-middle server can supply an arbitrarily\nlarge SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client\nruns it inline with no upper bound, pinning a `tokio` worker thread for minutes\nper connection, possibly stalling the whole async runtime.\n\nApplications that connect only to a trusted database are not exposed; the risk\napplies to clients that may connect to untrusted or user-supplied servers, or\nwhose connection can be intercepted by a man-in-the-middle.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "postgres-protocol"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0.3.0"
      }, {
        "fixed" : "0.6.12"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/rust-postgres/rust-postgres/commit/d40097a36a85068ea50a3afbf0ce154ba439e7f0"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rust-postgres/rust-postgres"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rust-postgres/rust-postgres/releases/tag/postgres-protocol-v0.6.12"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2026-0179.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-24T19:43:31Z",
    "nvd_published_at" : null
  }
}