PostgresNIO processes unencrypted bytes from man-in-the-middle

PostgresNIO, a Swift PostgreSQL client, fails to properly verify TLS connections before processing server responses, allowing attackers on the network to intercept and inject fake data into the first queries sent by the client. This undermines the protection that TLS encryption is supposed to provide.

The vulnerability exists in PostgresNIO versions before 1.14.2 where the client processes unencrypted or unverified bytes from the server before completing TLS handshake validation. An attacker positioned as a man-in-the-middle can inject malicious responses to early queries, exploiting insufficient verification of the TLS session initialization. The attack requires network proximity but bypasses certificate verification mechanisms.