RUSTSEC-2026-0178: Panic on a `DataRow` with fewer fields than columns allows denial of service

> Panic on a `DataRow` with fewer fields than columns allows denial of service

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `tokio-postgres` |
| Version | `0.7.13` |
| URL | [https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1](https://github.com/rust-postgres/rust-postgres/commit/7a00ffa9ad4d951ec0a4564b52f1780fa9d353c1) |
| Date | 2026-06-12 |
| Patched versions | `>=0.7.18` |
| Unaffected versions | `<0.4.0` |

A malicious or compromised server can send a row containing fewer fields than
its row description declares columns. Reading one of the missing columns then
panics with an out-of-bounds index, aborting the calling task. This affects even
the otherwise non-panicking `try_get`, and both `Row` and `SimpleQueryRow`.

Applications that connect only to a trusted database are not exposed; the risk
applies to clients that may connect to untrusted or user-supplied servers, or
whose connection can be intercepted by a man-in-the-middle.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0178.html) for additional details.