GHSA-rgqc-3x5p-6gwg postgres-protocol: Panic decoding a malformed `hstore` value allows denial of service
A malicious server can cause a Rust postgres client to panic and crash by sending a malformed hstore value, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-rgqc-3x5p-6gwg?
GHSA-rgqc-3x5p-6gwg is a denial of service vulnerability in postgres-protocol, published on 12 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A malicious or compromised server can return a binary hstore value with an
invalid internal length field, causing the client to panic while decoding it.
Applications that connect only to a trusted database are not exposed; the risk applies to clients that may connect to untrusted or user-supplied servers, or whose connection can be intercepted by a man-in-the-middle.
Which versions are affected by GHSA-rgqc-3x5p-6gwg?
3 open source packages ship an affected version, including postgres-protocol.
| Package | Affected | Fixed in |
|---|---|---|
postgres-protocol crates.io | All versions | 0.6.12 |
postgres-protocol crates.io | All versions | 0.6.12 |
postgres-protocol crates.io | From 0.0.0-0 | 0.6.12 |
How do I fix GHSA-rgqc-3x5p-6gwg?
Upgrade postgres-protocol to 0.6.12 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-rgqc-3x5p-6gwg being exploited?
There is no known exploitation of GHSA-rgqc-3x5p-6gwg in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2026-0180.