Threats tagged 'rustsec-2026-0459'

SQLite versions prior to 3.54.0 have a vulnerability where opening a database file alongside a write-ahead-log file with a differing page size can cause queries to return uninitialized page-cache memory, potentially leaking stale process memory. The Rust crate libsqlite3-sys, when built with its bundled SQLite source between versions 0.6.0 and before 0.39.0, is affected due to bundling vulnerable SQLite versions. The issue requires local access and crafted files. The vulnerability is fixed in libsqlite3-sys version 0.39.0, which bundles SQLite 3.54.0.