RUSTSEC-2026-0178: Panic on a `DataRow` with fewer fields than columns allows denial of service
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
Research direction
Start by locating where the postgresql gateway declares or uses tokio-postgres, then review the linked advisory and commit for the affected DataRow behavior. Confirm whether the project resolves version 0.7.17 and identify the relevant validation or integration checks. Done means the vulnerable version is no longer used and the gateway’s checks cover rows with fewer fields than declared columns.
Written by the indexing model from the issue text.
Description
Panic on a
DataRowwith fewer fields than columns allows denial of service
| Details | |
|---|---|
| Package | tokio-postgres |
| Version | 0.7.17 |
| URL | https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1 |
| Date | 2026-06-12 |
| Patched versions | >=0.7.18 |
| Unaffected versions | <0.4.0 |
A malicious or compromised server can send a row containing fewer fields than
its row description declares columns. Reading one of the missing columns then
panics with an out-of-bounds index, aborting the calling task. This affects even
the otherwise non-panicking try_get, and both Row and SimpleQueryRow.
Applications that connect only to a trusted database are not exposed; the risk
applies to clients that may connect to untrusted or user-supplied servers, or
whose connection can be intercepted by a man-in-the-middle.
See advisory page for additional details.
- Dominant language
- Rust
- Stars
- 0
- Forks
- 2
- Avg merge
- 3d 24m
- Merged PRs (30d)
- 3
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/postgresql-trino-gateway
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 48/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
All issues in stackabletech/postgresql-trino-gateway
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
bug triage:deciding
Difficulty 1/5 Under an hour Newbie friendliness 88/100
open-telemetry/otel-arrow#4132 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100