GHSA-q8x8-jrhj-fh9p RUSTSEC-2026-0137

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

Medium crates.io

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-188 Reliance on Data/Memory Layout
Fix: 2.3.8; Upgrade diesel to this version or later

Description

Diesel allows to register custom aggregate SQL functions for SQLite via the SqliteAggregate interface.

To store an instance of the custom aggregate processor Diesel relied on the sqlite3_aggregate_context function provided by sqlite. This function doesn't provide any guarantees about alignment of the returned allocation, which in turn can lead to problems if the type implementing requires a special alignment, e.g. via a custom #[align(x)] attribute on the type implementing this trait. This affects any user of SqliteAggregate that registers the custom aggregate function with an SQLite connection, while using a non-standard alignment on the type implementing this trait.

Mitigation

The preferred mitigation to the outlined problem is to update to a Diesel version 2.3.8 or newer, which includes fixes for the problem.

Resolution

Diesel now allocates the corresponding memory on Rust side to get a correctly aligned allocation.

Affected versions

crates.io

Package	Vulnerable	Fixed in
diesel	`< 2.3.8`	`2.3.8`
diesel	`>= 0.0.0-0, < 2.3.8`	`2.3.8`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

diesel crates.io → `2.3.8`

cargo

cargo update -p diesel --precise 2.3.8

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): Low
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-188: Reliance on Data/Memory Layout

The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.

How to prevent it

Implementation, Architecture and Design: In flat address space situations, never allow computing memory addresses as offsets from another memory address.
Architecture and Design: Fully specify protocol layout unambiguously, providing a structured grammar (e.g., a compilable yacc grammar).
Testing: Testing: Test that the implementation properly handles each case in the protocol grammar.

References

Packages

Timeline

Apr 24, 2026 Published
May 20, 2026 Last updated by the source

Advisory	Severity	Why it's related
GHSA-ggxf-9f6j-w742 Diesel has possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`	Medium	Also affects diesel
RUSTSEC-2026-0135 Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend	Not rated yet	Also affects diesel
RUSTSEC-2026-0134 Unsound access to padding bytes while serializing date/time values using the Mysql backend	Not rated yet	Also affects diesel
GHSA-m9p2-fxp5-v3fp Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`	Medium	Also affects diesel
GHSA-h5x4-m2qf-r4f2 Diesel's SQLite backend has possible UTF-8 corruption	High	Also affects diesel
GHSA-wq9x-qwcq-mmgf Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts	High	Also affects diesel
RUSTSEC-2021-0037 Fix a use-after-free bug in diesels Sqlite backend	Critical	Also affects diesel

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor