Vulnerability CriticalRUSTSEC-2021-0037 · diesel
RUSTSEC-2021-0037: Fix a use-after-free bug in diesels Sqlite backend
Short answerA security vulnerability in the diesel crate: Fix a use-after-free bug in diesels Sqlite backend. Critical severity (CVSS 9.8). Fixed in 1.4.6: update to a fixed version.
| Crate | diesel |
|---|---|
| Type | Vulnerability (memory-corruption) |
| Affected versions | Before 1.4.6. |
| Fixed in | 1.4.6 |
| Severity | Critical, CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2021-03-05 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2021-28305, GHSA-j8q9-5rp9-4mv9 |
| Affected functions | diesel::SqliteConnection::query_by_name |
What to do
- See which version you have:
cargo tree -i diesel(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p diesel. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplediesel = "1.4.6") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
We've misused sqlite3_column_name. The SQLite documentation states that the following:
> The returned string pointer is valid until either the prepared statement > is destroyed by sqlite3_finalize() or until the statement is automatically > reprepared by the first call to sqlite3_step() for a particular > run or until the next call to sqlite3_column_name() > or sqlite3_column_name16() on the same column.
As part of our query_by_name infrastructure we've first received all field names for the prepared statement and stored them as string slices for later use. After that we called sqlite3_step() for the first time, which invalids the pointer and therefore the stored string slice.
References
- Package: crates.io/crates/diesel
- Advisory: rustsec.org/advisories/RUSTSEC-2021-0037.html
- Web: github.com/diesel-rs/diesel/pull/2663
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for diesel
- VulnerabilityRUSTSEC-2024-0365 · 2024-08-23Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts
- UnsoundRUSTSEC-2026-0111 · 2026-04-24Possible UTF-8 corruption in Diesels SQLite backend
- UnsoundRUSTSEC-2026-0134 · 2026-04-24Unsound access to padding bytes while serializing date/time values using the Mysql backend
- UnsoundRUSTSEC-2026-0135 · 2026-04-24Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend
- VulnerabilityRUSTSEC-2026-0136 · 2026-04-24Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`
- VulnerabilityRUSTSEC-2026-0137 · 2026-04-24Possible unaligned data access for implementations of `SqliteAggregate`
- UnsoundRUSTSEC-2026-0172 · 2026-06-05Possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`
Up next
Same cratediesel: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?