Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

rusqlite before 0.23.0 may cause memory errors

CVE-2020-35866 · published 5 years ago
Summary

The rusqlite library for the Rust programming language, versions prior to 0.23.0, contains a flaw that can break the program's memory handling. This could lead to crashes or unexpected behavior when certain database modules are created. Upgrade to version 0.23.0 or newer to eliminate the risk.

What to do
  • Update thomcc rusqlite to version 0.23.0.
  • Update rusqlite_project rusqlite to version 0.23.0 or later.
Affected software
Ecosystem VendorProductAffected versions
rust thomcc rusqlite < 0.23.0
Fix: upgrade to 0.23.0
– rusqlite_project rusqlite < 0.23.0
cpe:2.3:a:rusqlite_project:rusqlite:*:*:*:*:*:rust:*:*
Original advisory text
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.
An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-362Race Condition
CWE-416Use After Free
Timeline
Published31 Dec 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-28ph-f7gx-fqj8 · GHSA
CVE-2020-35867 · NVD
CVE-2020-35866 · OSV
Track software like this
Free during beta