[tobyhede]

Vanta finding — CIP-3939

Package	postgres-protocol (transitive, via cipherstash-client → postgres-types)
Old version	0.6.7
New version	0.6.12
Advisory	GHSA-5x78-73v4-xg6w / RUSTSEC-2026-0179
Affected range	>= 0.3.0, < 0.6.12
Fixed in	0.6.12

Impact: a malicious, compromised, or MITM'd Postgres server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication; the client runs the key derivation inline with no upper bound, pinning a tokio worker thread for minutes per connection and potentially stalling the async runtime.

Change

cargo update -p postgres-protocol --precise 0.6.12 — semver-compatible within 0.6.x, so this is a Cargo.lock-only change. No manifest edits.

Cargo.lock now contains exactly one postgres-protocol package entry, at 0.6.12; nothing below 0.6.12 remains.

Verification

• CI green on this branch — test (cargo test --all-targets against local DynamoDB with the CS_* credentials, plus cargo test --doc), format, and clippy all pass.
• Locally: cargo build --workspace passes and doc-tests pass 18/18. The local cargo test --workspace run could not be conclusive on its own — the integration tests need the DynamoDB service and CipherStash credentials that only CI supplies — which is what the CI run above covers.

https://claude.ai/code/session_012753nvQC2ku4Ar6s4qdaft

[freshtonic]

Verified that postgres-protocol 0.6.12 is the first patched version for GHSA-5x78-73v4-xg6w. Reproducing cargo update -p postgres-protocol --precise 0.6.12 from main produced a byte-for-byte identical Cargo.lock, with exactly one postgres-protocol entry at 0.6.12. The dependency graph resolves correctly, CI is green, and doc tests pass 18/18.

Non-blocking documentation note: the PR description abbreviates the dependency path. The full path is cipherstash-dynamodb → cipherstash-client → cllw-ore → postgres-types → postgres-protocol.