Diesels SQLite backend · Possible UTF-8 corruption
Affects dieselSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 2.3.8
Data as of 27 Oct 2026, 01:58 UTC
What to do
Upgrade diesel to 2.3.8.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.iodieselpkg:cargo/dieselOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Update Diesel to version 2.3.8 or newer, which includes the fix that properly validates UTF-8 encoding before constructing Rust string slices from SQLite query results. This update addresses the root cause and restores safety guarantees.
Description
A vulnerability in Diesel's SQLite backend arises from incorrect assumptions about UTF-8 encoding when deserializing query results. Diesel used the sqlite3_value_text function assuming it always returns valid UTF-8 strings, but for SQLite BLOB types, this can contain arbitrary bytes, violating Rust's string safety guarantees. This issue is fixed in Diesel version 2.3.8.