RUSTSEC-2026-0180: Panic decoding a malformed `hstore` value allows denial of service

> Panic decoding a malformed `hstore` value allows denial of service

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `postgres-protocol` |
| Version | `0.6.8` |
| URL | [https://github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d](https://github.com/rust-postgres/rust-postgres/commit/a7cf84b5c46431cbca9d8ff50508c23f446efa7d) |
| Date | 2026-06-12 |
| Patched versions | `>=0.6.12` |

A malicious or compromised server can return a binary `hstore` value with an
invalid internal length field, causing the client to panic while decoding it.

Applications that connect only to a trusted database are not exposed; the risk
applies to clients that may connect to untrusted or user-supplied servers, or
whose connection can be intercepted by a man-in-the-middle.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0180.html) for additional details.