Advisory Database
  • Advisories
  • Dependency Scanning
  1. cargo
  2. ›
  3. diesel
  4. ›
  5. GHSA-q8x8-jrhj-fh9p

GHSA-q8x8-jrhj-fh9p: Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

May 19, 2026

Diesel allows to register custom aggregate SQL functions for SQLite via the SqliteAggregate interface.

To store an instance of the custom aggregate processor Diesel relied on the sqlite3_aggregate_context function provided by sqlite. This function doesn’t provide any guarantees about alignment of the returned allocation, which in turn can lead to problems if the type implementing requires a special alignment, e.g. via a custom #[align(x)] attribute on the type implementing this trait. This affects any user of SqliteAggregate that registers the custom aggregate function with an SQLite connection, while using a non-standard alignment on the type implementing this trait.

References

  • github.com/advisories/GHSA-q8x8-jrhj-fh9p
  • github.com/diesel-rs/diesel/pull/5042
  • rustsec.org/advisories/RUSTSEC-2026-0137.html

Code Behaviors & Features

Detect and mitigate GHSA-q8x8-jrhj-fh9p with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 2.3.8

Fixed versions

  • 2.3.8

Solution

Upgrade to version 2.3.8 or above.

Impact 4.8 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-188: Reliance on Data/Memory Layout

Source file

cargo/diesel/GHSA-q8x8-jrhj-fh9p.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 23 Jun 2026 12:24:01 +0000.