RUSTSEC-2026-0178: Panic on a `DataRow` with fewer fields than columns allows denial of service

Panic on a DataRow with fewer fields than columns allows denial of service

A malicious or compromised server can send a row containing fewer fields than
its row description declares columns. Reading one of the missing columns then
panics with an out-of-bounds index, aborting the calling task. This affects even
the otherwise non-panicking try_get, and both Row and SimpleQueryRow.

Applications that connect only to a trusted database are not exposed; the risk
applies to clients that may connect to untrusted or user-supplied servers, or
whose connection can be intercepted by a man-in-the-middle.

See advisory page for additional details.

Start by locating where the postgresql gateway declares or uses tokio-postgres, then review the linked advisory and commit for the affected DataRow behavior. Confirm whether the project resolves version 0.7.17 and identify the relevant validation or integration checks. Done means the vulnerable version is no longer used and the gateway’s checks cover rows with fewer fields than declared columns.