Status: Patched

This vulnerability has been verified as resolved and deployed.

CubeHigh2026-07-23

Oversized PostgreSQL startup frame can terminate the Cube service

Summary

A pre-authentication PostgreSQL length prefix became an unchecked allocation size

Any network client reaching Cube's optional PostgreSQL SQL interface could send a four-byte frame length near 0xffffffff, causing the native service to attempt a multi-gigabyte allocation before authentication and terminate under ordinary memory limits.

Root cause. read_contents() accepted an untrusted unsigned protocol length, subtracted the header size, and resized a Vec to the declared body length without a server-owned maximum or fallible reserve. The same primitive affected startup, authentication, and later frontend packets.

Remediation evidence. Cube acknowledged the disclosure and merged exact PR #11339 on 23 July 2026. The patch bounds PostgreSQL startup, authentication, and authenticated frontend frames before allocation and adds boundary regression coverage.

CVSS Score

VectorN

ComplexityL

PrivilegesN

User InteractionN

ScopeU

ConfidentialityN

IntegrityN

AvailabilityH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Location

SourceLine 95

rust/cubesql/pg-srv/src/buffer.rs

read_contents()

SinkLine 116

rust/cubesql/pg-srv/src/buffer.rs

read_contents()

Source-to-Sink Analysis

rust/cubesql/cubesql/src/sql/postgres/service.rs:34

Enabling pgSqlPort exposes the PostgreSQL-compatible listener, typically on all interfaces.

RUST

let listener = TcpListener::bind(self.address.clone()).await?;

rust/cubesql/cubesql/src/sql/postgres/shim.rs:208

A newly accepted socket enters initial-message parsing before any database authentication succeeds.

RUST

let (initial_parameters, auth_method) =
  self.process_initial_message().await?;

rust/cubesql/pg-srv/src/buffer.rs:95

The vulnerable reader converted the attacker length to usize and resized a buffer to the complete declared body.

RUST

let body_length = reader.read_u32().await? - 4;
let mut buffer = vec![0; body_length as usize];
reader.read_exact(&mut buffer).await?;

Impact Analysis

Critical Impact

A single unauthenticated connection can terminate a memory-constrained Cube SQL service, and a few concurrent requests can exhaust a larger host. This is a direct remote availability impact with no prerequisite account.

Attack Surface

Cube's optional PostgreSQL-compatible SQL listener when reachable from an untrusted network.

Preconditions

The listener is enabled and network-reachable. The attacker needs no Cube account, PostgreSQL credential, or victim interaction.

Proof of Concept

Environment Setup

Run the affected Cube SQL server in a disposable container with a conservative memory limit and expose its test PostgreSQL port only to the lab client.

Target Configuration

Set CUBEJS_PG_SQL_PORT and confirm a legitimate client can connect before the test.

Exploit Delivery

Open a raw TCP socket and send the big-endian bytes ff ff ff ff, then keep the connection open without providing the declared body.

Outcome

PR #11339 rejects the frame as oversized before reserving memory, closes the malicious connection, and keeps the service available.

Expected Response: The vulnerable process attempts the multi-gigabyte allocation and exits or is killed by the container's memory controller; a subsequent legitimate connection fails.

Run this level of analysis on your repo.

Winfunc traces source-to-sink paths, validates exploitability, and gives your team patch-ready remediation.

Vulnerability Detection

View Patch PRVerify fix on GitHub