—
GO-2026-6168
Unbounded iteration count causes CPU denial of service in github.com/lib/pq/scram
Details
The SCRAM client in github.com/lib/pq/scram accepts an attacker-controlled iteration count with no upper bound and immediately performs that many PBKDF2-style HMAC rounds. A PostgreSQL endpoint or active network attacker can send a valid SCRAM server-first message with a large iteration count (such as i=2147483647), causing client authentication to consume excessive CPU resources before verifying the server signature.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/lib/pq
Introduced in:
1.1.0 No fixed version published yet for github.com/lib/pq (go modules). Pin to a known-safe version or switch to an alternative.