GHSA-4qr3-m7ww-hh9g CVE-2021-45713 CVE-2021-45714 CVE-2021-45715 CVE-2021-45716 CVE-2021-45717 CVE-2021-45718 CVE-2021-45719 GHSA-87xh-9q6h-r5cc GHSA-92cx-4xm7-jr9m GHSA-cm8g-544f-p9x9 GHSA-f6f2-3w33-54r9 GHSA-g4g4-3pqw-8m7f GHSA-g87r-23vw-7f87 GHSA-q89g-4vhh-mvvm RUSTSEC-2021-0128

Use After Free in rusqlite

High crates.io

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): 1.22%; Chance of exploitation in the next 30 days. Higher than 68.66% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-416 Use After Free
Fix: 0.25.4; Upgrade rusqlite to this version or later

Description

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commit_hook has a use-after-free.

Affected versions

crates.io

Package	Vulnerable	Fixed in
rusqlite	`>= 0.25.0, < 0.25.4`	`0.25.4`
rusqlite	`>= 0.26.0, < 0.26.2`	`0.26.2`
rusqlite	`>= 0.25.0, < 0.25.4` `>= 0.26.0-0, < 0.26.2`	`0.25.4` `0.26.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

rusqlite crates.io → `0.25.4`

cargo

cargo update -p rusqlite --precise 0.25.4

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-416: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

How to prevent it

Architecture and Design: Choose a language that provides automatic memory management.
Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

References

Advisories

Packages

Timeline

Dec 7, 2021 Published
Mar 15, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-28ph-f7gx-fqj8 Data races in rusqlite	Critical	Also affects rusqlite
CVE-2026-109619 PHP has various global state that temporarily points into request memory.	Critical Known exploited	Same weakness, CWE-416
CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.	Critical Known exploited	Same weakness, CWE-416
GHSA-7mwm-ghpf-9vrm Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform	High	Same weakness, CWE-416
GHSA-4rr5-89j8-mwwm Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer	High	Same weakness, CWE-416
GHSA-wq5f-xc86-pv6w sharp : Vulnerability in librsvg dependency CVE-2026-96889	High	Same weakness, CWE-416
RUSTSEC-2026-0326 Rooting for GC values live across `try_call` may be missing, causing GC heap corruption	Medium	Same weakness, CWE-416
CVE-2026-68820 Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.	High Known exploited	Same weakness, CWE-416

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor