Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. diesel
  4. ›
  5. GHSA-h5x4-m2qf-r4f2

GHSA-h5x4-m2qf-r4f2: Diesel's SQLite backend has possible UTF-8 corruption

May 5, 2026 (updated June 18, 2026)

Diesel uses the sqlite3_value_text function to receive strings from SQLite while deserializing query results. We misinterpreted the corresponding SQLite documentation that this function always returns a UTF-8 encoded string values as *const c_char. Based on that we used str::from_utf8_unchecked to construct a Rust string slice without any additional UTF-8 checks in place. It turned out that this function doesn’t always return correct UTF-8 strings. For field of the SQLite side storage type BLOB this pointer can contain arbitrary bytes, which makes the usage of str::from_utf8_unchecked unsound as this violates the safety contract of str to only contain valid UTF-8 encoded Strings.

References

  • github.com/advisories/GHSA-h5x4-m2qf-r4f2
  • github.com/diesel-rs/diesel/pull/5042
  • rustsec.org/advisories/RUSTSEC-2026-0111.html

Code Behaviors & Features

Detect and mitigate GHSA-h5x4-m2qf-r4f2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 2.3.8

Fixed versions

  • 2.3.8

Solution

Upgrade to version 2.3.8 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-20: Improper Input Validation

Source file

cargo/diesel/GHSA-h5x4-m2qf-r4f2.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:17 +0000.