postgres-protocol Crate: Potential CPU-Exhaustion Denial of Service
- Severity
- HIGH
- Affected component
- postgres-protocol (cargo)
- Affected versions
- >= 0.3.0, < 0.6.12 or < 0.6.12 or >= 0.3.0, < 0.6.12 or >= 0.0.0-0, < 0.6.12
- Patched version
- Not yet available
An early warning has been issued regarding a potential denial of service vulnerability in the postgres-protocol crate. This vulnerability, which is under investigation, could allow a malicious server to cause CPU exhaustion by supplying an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication.
What happened
Reportedly, a malicious server can exploit the postgres-protocol crate by supplying an unbounded SCRAM-SHA-256 PBKDF2 iteration count during authentication. This could lead to a CPU-exhaustion denial of service. The affected versions are >= 0.3.0, < 0.6.12 or < 0.6.12 or >= 0.3.0, < 0.6.12 or >= 0.0.0-0, < 0.6.12. The issue is tracked under GHSA-5X78-73V4-XG6W and was first flagged on 2026-08-24T19:43:31+00:00.
The vulnerability has not been exploited in the wild as of the latest reports. It is recommended to monitor for updates and consider using trusted databases or mitigating against untrusted servers to reduce potential risk.
What to do about it
- Monitor the primary sources for updates on this vulnerability.
- Consider using trusted databases to mitigate against potential threats.
- Avoid interacting with untrusted servers to reduce the risk of exploitation.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
postgres-protocol is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using postgres-protocol crate versions >= 0.3.0, < 0.6.12 or < 0.6.12 or >= 0.3.0, < 0.6.12 or >= 0.0.0-0, < 0.6.12.
What should I do right now?
Monitor for updates and consider using trusted databases or mitigating against untrusted servers.
Has a fix been released?
No official fix has been published yet. Continue to monitor the sources for updates.