RUSTSEC-2026-0502

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0502

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0502.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0502

Aliases

CVE-2026-119375
GHSA-72w2-rjgg-q729
RUSTSEC-2026-0459

Published

2026-10-30T12:00:00Z

Modified

2026-11-12T08:11:00Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

`sqlcipher-src` via C SQLite CVE-2026-119375

Details

SQLite versions before 3.54.0 can return uninitialized page-cache memory when a process opens a database file together with a sibling write-ahead-log (-wal) file whose page size differs from the database's. A crafted pair of files can make ordinary queries return stale bytes from the process's memory. The attack vector is local and needs the victim to open the files.

sqlcipher-src ships the SQLCipher amalgamation (SQLCipher is built on SQLite and contains the same sqlite3WalReadFrame code) for -sys crates to compile, so a build that uses it is susceptible to the vulnerability. The releases 419.0.3 to 419.0.6 bundle SQLCipher 4.19.0 on SQLite 3.53.4 and are affected. sqlcipher-src was updated in 420.0.0 (SQLCipher 4.20.0 on SQLite 3.54.1), which contains the fix. The releases 0.1.0 and 0.1.1 contain no SQLCipher source. libsqlite3-sys 0.39.0 and 0.39.1 depend on sqlcipher-src =419.0.6 for their bundled-sqlcipher feature.

Only a process that opens a database file, with its -wal, that a less trusted party could have written is exposed.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / sqlcipher-src

Package

Name: sqlcipher-src; View open source insights on deps.dev
Purl: pkg:cargo/sqlcipher-src

Affected ranges

Type: SEMVER
Events: Introduced

419.0.3

Fixed

420.0.0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [],
        "os": []
    }
}