Skip to content
Fencer Intel
no cvss —

RUSTSEC-2026-0134 json

Unsound access to padding bytes while serializing date/time values using the Mysql backend

published 6mo ago modified 5mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Diesel relies on libmysqlclient for interacting with Mysql compatible databases. This library requires to provide date/time values according to the byte layout of their `MYSQL_TIME` type.

Diesel replicated this type as `#[repr(C)]` struct, populated all the fields of this struct and then casted this value to an array of bytes. As this cast exposes padding bytes contained in this struct, this is undefined behaviour.

This vulnerability affects any user serializing date/time values using the Mysql backend.

## Mitigation

The preferred mitigation to the outlined problem is to update to Diesel version 2.3.8 or newer, which includes fixes for the problem.

## Resolution

Diesel now manually serializes the relevant data without accessing the padding bytes.

Patch / fix

  • crates.io diesel 2.3.8

Is RUSTSEC-2026-0134 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io diesel
>=0.0.0-0, <2.3.8
2.3.8

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.