RUSTSEC-2026-0179: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

> Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `postgres-protocol` |
| Version | `0.6.8` |
| URL | [https://github.com/rust-postgres/rust-postgres/commit/d40097a36a85068ea50a3afbf0ce154ba439e7f0](https://github.com/rust-postgres/rust-postgres/commit/d40097a36a85068ea50a3afbf0ce154ba439e7f0) |
| Date | 2026-06-12 |
| Patched versions | `>=0.6.12` |
| Unaffected versions | `<0.3.0` |

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily
large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client
runs it inline with no upper bound, pinning a `tokio` worker thread for minutes
per connection, possibly stalling the whole async runtime.

Applications that connect only to a trusted database are not exposed; the risk
applies to clients that may connect to untrusted or user-supplied servers, or
whose connection can be intercepted by a man-in-the-middle.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0179.html) for additional details.