Executive brief
Diesel is a popular database toolkit and ORM for the Rust programming language. A vulnerability in its SQLite integration could allow for memory corruption or application crashes when using custom aggregate functions. This occurs because the library does not properly align memory for certain data types, potentially leading to unstable behavior or security breaches in applications that perform complex database calculations.
Technical details
The vulnerability exists in the `SqliteAggregate` interface where Diesel relied on the `sqlite3_aggregate_context` function from the SQLite C API to allocate memory for custom aggregate processors. This SQLite function does not guarantee memory alignment, which violates Rust's safety requirements when the implementing type requires specific alignment (e.g., via `#[repr(align(x))]`). Creating a Rust reference to unaligned memory is considered undefined behavior (UB). An attacker who can influence the execution of these custom aggregate functions might trigger memory corruption or crashes. The issue is resolved in version 2.3.8 by moving the allocation to the Rust side to ensure proper alignment.
Affected products
- diesel-rs diesel < 2.3.8
Timeline
- 2026-04-24: other: Issue reported and pull request created
- 2026-05-19: advisory: GitHub Advisory published
- 2026-05-19: patched: Version 2.3.8 released