RUSTSEC-2026-0179: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service

A malicious, compromised, or man-in-the-middle server can supply an arbitrarily
large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client
runs it inline with no upper bound, pinning a tokio worker thread for minutes
per connection, possibly stalling the whole async runtime.

Applications that connect only to a trusted database are not exposed; the risk
applies to clients that may connect to untrusted or user-supplied servers, or
whose connection can be intercepted by a man-in-the-middle.

See advisory page for additional details.

Il report riguarda il pacchetto Rust postgres-protocol; inizia dal commit upstream collegato e dall’advisory RustSec per determinare come graph-node risolve questa dipendenza. Conferma che la dipendenza utilizzi una versione corretta di postgres-protocol (e=0.6.12) e che il percorso di autenticazione SCRAM interessato sia stato risolto.