# diesel (crates.io) vulnerabilities Source: https://junglewise.ai/threats/technologies/diesel Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/diesel.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in diesel (crates.io): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, Diesel use after free in SqliteConnection deserialize_readonly_database, was published on 16 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 13 (0 critical, 0 exploited in the wild) ## About diesel (crates.io) A safe, extensible ORM and query builder for Rust. ## Latest diesel (crates.io) vulnerabilities - [Diesel use after free in SqliteConnection deserialize_readonly_database](https://junglewise.ai/threats/diesel-use-after-free-in-sqliteconnection-deserialize-readonly-database-dadf7b98) (medium, CVSS 6.9, published 16 Jul 2026) - [RUSTSEC-2026-0172 - Possible use after free when deserializing a SQLite database via…](https://junglewise.ai/threats/rustsec-2026-0172-possible-use-after-free-when-deserializing-a-sqlite-3bbb802d) (info, published 5 Jun 2026) - [Diesel argument injection in PostgreSQL COPY FROM and COPY TO](https://junglewise.ai/threats/diesel-argument-injection-in-postgresql-copy-from-and-copy-to-1fd3966b) (medium, CVSS 6.9, published 19 May 2026) - [Diesel unaligned data access in SqliteAggregate](https://junglewise.ai/threats/diesel-unaligned-data-access-in-sqliteaggregate-27fb382f) (medium, CVSS 6.3, published 19 May 2026) - [Diesel SQLite backend UTF-8 corruption in deserialization](https://junglewise.ai/threats/diesel-sqlite-backend-utf-8-corruption-in-deserialization-42824b77) (high, CVSS 8.7, published 5 May 2026) - [RUSTSEC-2026-0134 - Unsound access to padding bytes while serializing date/time values using the Mysql backend](https://junglewise.ai/threats/rustsec-2026-0134-unsound-access-to-padding-bytes-while-serializing-f2bc69db) (info, published 24 Apr 2026) - [RUSTSEC-2026-0136 - Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`](https://junglewise.ai/threats/rustsec-2026-0136-command-injection-in-diesel-s-implementation-of-copy-1779c5a9) (info, published 24 Apr 2026) - [RUSTSEC-2026-0111 - Possible UTF-8 corruption in Diesels SQLite backend](https://junglewise.ai/threats/rustsec-2026-0111-possible-utf-8-corruption-in-diesels-sqlite-backend-2842c0b9) (info, published 24 Apr 2026) - [RUSTSEC-2026-0137 - Possible unaligned data access for implementations of `SqliteAggregate`](https://junglewise.ai/threats/rustsec-2026-0137-possible-unaligned-data-access-for-implementations-of-9203faa5) (info, published 24 Apr 2026) - [RUSTSEC-2026-0135 - Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend](https://junglewise.ai/threats/rustsec-2026-0135-unsound-transmute-while-debug-display-printing-batch-c2b1c0e1) (info, published 24 Apr 2026) - [Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts](https://junglewise.ai/threats/diesel-vulnerable-to-binary-protocol-misinterpretation-caused-by-9174b6fc) (low, CVSS 3.1, published 23 Aug 2024) - [RUSTSEC-2024-0365 - Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts](https://junglewise.ai/threats/rustsec-2024-0365-binary-protocol-misinterpretation-caused-by-1316cce7) (info, published 23 Aug 2024) - [CVE-2021-28305: RUSTSEC-2021-0037 - Fix a use-after-free bug in diesels Sqlite backend](https://junglewise.ai/threats/cve-2021-28305-fix-a-use-after-free-bug-in-diesels-sqlite-backend) (low, CVSS 3.1, published 5 Mar 2021) ## Most severe diesel (crates.io) vulnerabilities - [Diesel SQLite backend UTF-8 corruption in deserialization](https://junglewise.ai/threats/diesel-sqlite-backend-utf-8-corruption-in-deserialization-42824b77) (high, CVSS 8.7, published 5 May 2026) - [Diesel use after free in SqliteConnection deserialize_readonly_database](https://junglewise.ai/threats/diesel-use-after-free-in-sqliteconnection-deserialize-readonly-database-dadf7b98) (medium, CVSS 6.9, published 16 Jul 2026) - [Diesel argument injection in PostgreSQL COPY FROM and COPY TO](https://junglewise.ai/threats/diesel-argument-injection-in-postgresql-copy-from-and-copy-to-1fd3966b) (medium, CVSS 6.9, published 19 May 2026) - [Diesel unaligned data access in SqliteAggregate](https://junglewise.ai/threats/diesel-unaligned-data-access-in-sqliteaggregate-27fb382f) (medium, CVSS 6.3, published 19 May 2026) - [CVE-2021-28305: RUSTSEC-2021-0037 - Fix a use-after-free bug in diesels Sqlite backend](https://junglewise.ai/threats/cve-2021-28305-fix-a-use-after-free-bug-in-diesels-sqlite-backend) (low, CVSS 3.1, published 5 Mar 2021) - [Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts](https://junglewise.ai/threats/diesel-vulnerable-to-binary-protocol-misinterpretation-caused-by-9174b6fc) (low, CVSS 3.1, published 23 Aug 2024) - [RUSTSEC-2026-0172 - Possible use after free when deserializing a SQLite database via…](https://junglewise.ai/threats/rustsec-2026-0172-possible-use-after-free-when-deserializing-a-sqlite-3bbb802d) (info, published 5 Jun 2026) - [RUSTSEC-2026-0134 - Unsound access to padding bytes while serializing date/time values using the Mysql backend](https://junglewise.ai/threats/rustsec-2026-0134-unsound-access-to-padding-bytes-while-serializing-f2bc69db) (info, published 24 Apr 2026) - [RUSTSEC-2026-0136 - Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`](https://junglewise.ai/threats/rustsec-2026-0136-command-injection-in-diesel-s-implementation-of-copy-1779c5a9) (info, published 24 Apr 2026) - [RUSTSEC-2026-0111 - Possible UTF-8 corruption in Diesels SQLite backend](https://junglewise.ai/threats/rustsec-2026-0111-possible-utf-8-corruption-in-diesels-sqlite-backend-2842c0b9) (info, published 24 Apr 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other crates.io technologies - [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb): 83 vulnerabilities - [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime): 67 vulnerabilities - [deno (crates.io)](https://junglewise.ai/threats/technologies/deno): 39 vulnerabilities - [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad): 27 vulnerabilities - [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh): 26 vulnerabilities - [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src): 26 vulnerabilities - [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl): 25 vulnerabilities - [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities - [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities - [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities - [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities - [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "diesel (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/diesel, 9 November 2026.