GHSA-5x78-73v4-xg6w Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
A malicious server can cause client CPU exhaustion via unbounded SCRAM iteration counts, impacting applications connecting to untrusted databases.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-5x78-73v4-xg6w?
GHSA-5x78-73v4-xg6w is a denial of service vulnerability in postgres-protocol, published on 12 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A malicious, compromised, or man-in-the-middle server can supply an arbitrarily
large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client
runs it inline with no upper bound, pinning a tokio worker thread for minutes
per connection, possibly stalling the whole async runtime.
Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
Which versions are affected by GHSA-5x78-73v4-xg6w?
3 open source packages ship an affected version, including postgres-protocol.
| Package | Affected | Fixed in |
|---|---|---|
postgres-protocol crates.io | From 0.3.0 | 0.6.12 |
postgres-protocol crates.io | From 0.3.0 | 0.6.12 |
postgres-protocol crates.io | From 0.3.0 | 0.6.12 |
How do I fix GHSA-5x78-73v4-xg6w?
Upgrade postgres-protocol to 0.6.12 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-5x78-73v4-xg6w being exploited?
There is no known exploitation of GHSA-5x78-73v4-xg6w in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0179.