MEDIUMCVSS 6.9
GHSA-rgqc-3x5p-6gwg
postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service
Summary
A malicious or compromised server can return a binary `hstore` value with an invalid internal length field, causing the client to panic while decoding it. Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| rust | postgres-protocol | — | 0.6.12 |
Remediation: Upgrade to 0.6.12 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.