Use After Free Vulnerability in Diesel Package: SQLite Database Deserialization Issue
Summary
GHSA-ggxf-9f6j-w742: Diesel allows loading a SQLite database from a byte buffer, represented as &[u8], at runtime via the SqliteConnection::deserialize_readonly_database function. Affects diesel versions < 2.3.10. Fixed in 2.3.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Diesel is a powerful Rust-based ORM (Object-Relational Mapping) library that facilitates interaction with databases in a type-safe manner. It supports various backends, including SQLite, and allows developers to perform complex queries while maintaining Rust's safety guarantees. However, a vulnerability has been identified in the way Diesel handles SQLite database deserialization, which could lead to serious memory management issues.
Vulnerability Detail
The vulnerability arises from Diesel's SqliteConnection::deserialize_readonly_database function, which allows loading a SQLite database from a byte buffer at runtime. In earlier versions, this buffer was passed directly to libsqlite3 without ensuring its lifetime, leading to a use-after-free scenario. If the buffer is dropped prematurely while the database connection is still active, libsqlite3 may attempt to access freed memory, potentially causing crashes or undefined behavior. This vulnerability affects users who do not manage the buffer's lifetime correctly.
How To Fix
Latest published version: 2.3.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the byte buffer passed to SqliteConnection::deserialize_readonly_database remains alive for the entire duration of the database connection. This can be done by storing the buffer in a variable that is not dropped until the connection is closed.
Conclusion
In summary, the Diesel package has a use-after-free vulnerability related to SQLite database deserialization. Users are advised to update to version 2.3.10 or newer to mitigate the risk. Proper management of the byte buffer's lifetime is crucial to prevent potential memory issues.
See every vulnerability recorded for diesel →
FAQ
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If left unaddressed, this vulnerability could lead to crashes or undefined behavior in your application due to memory access violations.
Yes, you should upgrade to Diesel version 2.3.10 or newer to mitigate this vulnerability.
The function affected is SqliteConnection::deserialize_readonly_database, which is used to load a SQLite database from a byte buffer.
References
Related vulnerabilities
Recent vulnerabilities recorded for diesel.
