Read the docs
TI-2026-66783 Aliases GHSA-q8x8-jrhj-fh9p

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

Priority LOW 38CWE-188Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Diesel allows to register custom aggregate SQL functions for SQLite via the `SqliteAggregate` interface. To store an instance of the custom aggregate processor Diesel relied on the `sqlite3_aggregate_context` function provided by sqlite. This function doesn't provide any guarantees about alignment of the returned allocation, which in turn can lead to problems if the type implementing requires a special alignment, e.g. via a custom `#[align(x)]` attribute on the type implementing this trait. This affects any user of `SqliteAggregate` that registers the custom aggregate function with an SQLite connection, while using a non-standard alignment on the type implementing this trait. ## Mitigation The preferred mitigation to the outlined problem is to update to a Diesel version 2.3.8 or newer, which includes fixes for the problem. ## Resolution Diesel now allocates the corresponding memory on Rust side to get a correctly aligned allocation.

Why it matters now

Fix Fixed diesel (crates.io): 2.3.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—diesel (crates.io)before 2.3.82.3.8Patch availableGHSA-q8x8-jrhj-fh9p
  • diesel (crates.io) Vendor— Affected before 2.3.8 Fixed in 2.3.8 Patch available GHSA-q8x8-jrhj-fh9p

Remediation

  • Fix · GHSA-q8x8-jrhj-fh9p diesel (crates.io) Fixed in 2.3.8 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-q8x8-jrhj-fh9p

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences