RUSTSEC-2021-0037 CVE-2021-28305 GHSA-j8q9-5rp9-4mv9
Fix a use-after-free bug in diesels Sqlite backend
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 1.32%
- Chance of exploitation in the next 30 days. Higher than 70.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-416 Use After Free
- Fix
1.4.6- Upgrade diesel to this version or later
Description
We've misused sqlite3_column_name. The
SQLite documentation
states that the following:
The returned string pointer is valid until either the prepared statement is destroyed by sqlite3_finalize() or until the statement is automatically reprepared by the first call to sqlite3_step() for a particular run or until the next call to sqlite3_column_name() or sqlite3_column_name16() on the same column.
As part of our query_by_name infrastructure we've first received all
field names for the prepared statement and stored them as string slices
for later use. After that we called sqlite3_step() for the first time,
which invalids the pointer and therefore the stored string slice.
Affected versions
crates.io
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
diesel crates.io → 1.4.6
- cargo
cargo update -p diesel --precise 1.4.6
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
How to prevent it
- Architecture and Design: Choose a language that provides automatic memory management.
- Implementation: When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-ggxf-9f6j-w742 Diesel has possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database` | Medium | Also affects diesel |
| RUSTSEC-2026-0135 Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend | Not rated yet | Also affects diesel |
| RUSTSEC-2026-0134 Unsound access to padding bytes while serializing date/time values using the Mysql backend | Not rated yet | Also affects diesel |
| GHSA-m9p2-fxp5-v3fp Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO` | Medium | Also affects diesel |
| GHSA-q8x8-jrhj-fh9p Diesel: Possible unaligned data access for implementations of `SqliteAggregate` | Medium | Also affects diesel |
| GHSA-h5x4-m2qf-r4f2 Diesel's SQLite backend has possible UTF-8 corruption | High | Also affects diesel |
| GHSA-wq9x-qwcq-mmgf Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts | High | Also affects diesel |
| CVE-2026-109619 PHP has various global state that temporarily points into request memory. | Critical Known exploited | Same weakness, CWE-416 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor