Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. diesel-async
  4. ›
  5. GHSA-ff9q-rm55-q7qr

GHSA-ff9q-rm55-q7qr: diesel-async may expose uninitialized padding bytes for MySQL temporal columns

May 7, 2026

diesel-async exposes uninitialized stack padding to safe code on every read of a MySQL DATE, TIME, DATETIME, or TIMESTAMP column. Reading that buffer is undefined behavior, and the leaked bytes can contain stale heap/stack contents, so this is both a soundness bug and a potential information-disclosure vector.

References

  • github.com/advisories/GHSA-ff9q-rm55-q7qr
  • github.com/diesel-rs/diesel_async
  • github.com/diesel-rs/diesel_async/commit/18f2c861c51b4a5f23a20bd749eba13737b9e4aa
  • github.com/diesel-rs/diesel_async/security/advisories/GHSA-ff9q-rm55-q7qr

Code Behaviors & Features

Detect and mitigate GHSA-ff9q-rm55-q7qr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.1.0 before 0.9.0

Fixed versions

  • 0.9.0

Solution

Upgrade to version 0.9.0 or above.

Impact 5.1 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Learn more about CVSS

Weakness

  • CWE-126: Buffer Over-read

Source file

cargo/diesel-async/GHSA-ff9q-rm55-q7qr.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 00:19:43 +0000.