Executive brief
Diesel, a popular database tool for the Rust programming language, contains a flaw in how it handles data from SQLite databases. If a database contains specifically formatted invalid data, it can cause the application to process information incorrectly, potentially leading to data corruption or application instability. Developers using Diesel with SQLite should update to the latest version to ensure their applications remain reliable and secure.
Technical details
Diesel's SQLite backend incorrectly assumed that the `sqlite3_value_text` function always returns valid UTF-8 encoded strings. Based on this assumption, the library used `str::from_utf8_unchecked` to construct Rust string slices. However, if an underlying SQLite column contains `BLOB` data with arbitrary bytes, this unchecked conversion violates Rust's safety contract that all `str` types must be valid UTF-8. An attacker who can influence the data stored in the SQLite database could trigger undefined behavior or memory corruption. The issue is fixed in version 2.3.8 by implementing proper UTF-8 validation.
Affected products
- diesel-rs diesel < 2.3.8
Timeline
- 2026-05-05: disclosed
- 2026-05-05: advisory
- 2026-05-05: patched: Fixed in version 2.3.8