RUSTSEC-2026-0172: Possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`

What to do

1. See which version you have: cargo tree -i diesel (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p diesel. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example diesel = "2.3.10") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

Diesel allows loading a SQLite database from a byte buffer, represented as &[u8], at runtime via the SqliteConnection::deserialize_readonly_database function. In previous versions of Diesel, this buffer was passed directly to libsqlite3. Since libsqlite3 requires the buffer to remain alive for as long as the database connection is open and Diesel did not ensure this as part of its safe API, callers of SqliteConnection::deserialize_readonly_database could drop the buffer prematurely. This prematurely drop caused libsqlite3 to operate on freed memory.

This vulnerability affects users of SqliteConnection::deserialize_readonly_database who drop the buffer passed to the function before they drop the database connection.

Mitigation

The preferred mitigation to the outlined problem is to update to Diesel version 2.3.10 or newer, which includes a fix for the problem. Alternatively users need to take to keep the buffer alive until the connection is dropped.

Resolution

Diesel now stores a copy of the buffer inside of the SqliteConnection object itself to keep it alive as long as the underlying libsqlite3 connection exists.

References

• Package: crates.io/crates/diesel
• Advisory: rustsec.org/advisories/RUSTSEC-2026-0172.html
• Web: github.com/diesel-rs/diesel/commit/1bc2ea46d9840e8d9af844239d3c84f37fe7d84b

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for diesel

• Vulnerability CriticalRUSTSEC-2021-0037 · 2021-03-05Fix a use-after-free bug in diesels Sqlite backend
• VulnerabilityRUSTSEC-2024-0365 · 2024-08-23Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts
• UnsoundRUSTSEC-2026-0111 · 2026-04-24Possible UTF-8 corruption in Diesels SQLite backend
• UnsoundRUSTSEC-2026-0134 · 2026-04-24Unsound access to padding bytes while serializing date/time values using the Mysql backend
• UnsoundRUSTSEC-2026-0135 · 2026-04-24Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend
• VulnerabilityRUSTSEC-2026-0136 · 2026-04-24Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`
• VulnerabilityRUSTSEC-2026-0137 · 2026-04-24Possible unaligned data access for implementations of `SqliteAggregate`

Full security history of diesel