Security problems with Rust crate `tiberius` plus options for drop-in replacement

[joelparkerhenderson]

Problem

mssql_server depends on the Rust crate tiberius which is experiencing multiple security problems and slow maintenance problems. Specifics below.

Solution

Consider changing from tiberius to one of the recent forks of the crate that provide the security updates and responsive maintenance.

• mssql - maintained by Joel Henderson (me)
• tiberius-ng - maintained by Matt Jackson

Mervyn, I'm inviting you as an admin of mssql if you would like to be one, because I want a good bus number; testcontainers is the #1 downloader of the old tiberius crate.

Either fork is fine IMHO, and you'll likely want to look at them first, because they're both very new. If you have questions or feedback etc. that's good too. My goal is to fix the security problem.

Code change

This code change is from Rust crate tiberius to mssql drop-in replacement.

 # Cargo.toml
-tiberius = { version = "0.12.3", default-features = false, features = [
+mssql = { version = "1.0.1", default-features = false, features = [
     "tds73",
     "rustls",
 ] }

// examples/mssql_server.rs
-let mut config = tiberius::Config::new();
+let mut config = mssql::Config::new();
 config.host(container.get_host().await?);
 config.port(container.get_host_port_ipv4(1433).await?);
-config.authentication(tiberius::AuthMethod::sql_server(
+config.authentication(mssql::AuthMethod::sql_server(
     "sa",
     MssqlServer::DEFAULT_SA_PASSWORD,
 ));
 config.trust_cert();

 let tcp = TcpStream::connect(config.get_addr()).await?;
 tcp.set_nodelay(true)?;
-let mut client = tiberius::Client::connect(config, tcp.compat_write()).await
+let mut client = mssql::Client::connect(config, tcp.compat_write()).await?;

(Same rename in src/mssql_server/mod.rs:124.)

If you prefer a PR, I can do that too.

Security specifics

1. Three unpatched RUSTSEC advisories — 2026-0098, 2026--0099, 2026-0104
2. Unnmerged fixes: prisma/tiberius#419 has been open since 2026-05-12 with no maintainer response.
3. Reachable panics from untrusted server input: #424 and #425 document 11 sites in the TDS decoder where a malformed/malicious server response aborts the client process rather than returning Err. Tracked by the RustSec working group at advisory-db#3148.
4. Maintenance appears stalled: no commits since 2026-03-06, 140 open issues, and a maintainer-handover request (#427) went unanswered for 11 days.