WS-2026-0039

A malicious, compromised, or man-in-the-middle PostgreSQL server can supply an arbitrarily large SCRAM-SHA-256 PBKDF2 iteration count during authentication. The client runs the key derivation inline with no upper bound, pinning a tokio worker thread for minutes per connection and possibly stallin...