RUSTSEC-2026-0172
NoneCVSS
—
EPSS
—
Published
Jun 5, 2026
CISA due date
—
The record
Possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | diesel | 0.0.0-0 | 2.3.10 |
Related vulnerabilities
- RUSTSEC-2026-0135 Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite… Also affects diesel
- RUSTSEC-2026-0137 Possible unaligned data access for implementations of `SqliteAggregate` Also affects diesel
- RUSTSEC-2026-0136 Command injection in Diesel's implementation of `COPY FROM`/`COPY TO` Also affects diesel
- RUSTSEC-2026-0134 Unsound access to padding bytes while serializing date/time values using the Mysql backend Also affects diesel
- RUSTSEC-2026-0111 Possible UTF-8 corruption in Diesels SQLite backend Also affects diesel