SQLITE3 · CVE-2026-128084 · Package
FIX → 2.10.2
sqlite3-ruby cast string lengths to int, so strings of 4 GiB or more wrap and SQLite reads only a prefix. An attacker who controls a very long SQL string can make the query drop trailing clauses such as a WHERE.
first public Oct 26, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only applications that use sqlite3-ruby 2.10.1 or earlier on 64-bit platforms and that can receive or build SQL or bound values of 4 GiB or larger. The advisory says most deployments reject request bodies that large before the application sees them, and the server must hold several copies of the string in memory. Teams whose inputs are capped far below 4 GiB can skip it.
Not affected if request-size-limit-below-4gib, sqlite3-ruby-2.10.2-or-later
Who cares ruby, rubygems, sqlite3-ruby
gem list sqlite3 or bundle list; versions 2.10.1 and earlier are affected.Upgrade to 2.10.2
2.10.2 or later.sqlite3-ruby cast Ruby string lengths (long) to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the query, for example dropping a trailing WHERE clause. The affected paths are:
Database#prepare, #execute, and related methodsStatement#bind_param and related methodsDatabase#create_function, #create_aggregate, and related methods)sqlite3 v2.10.2 raises RangeError when any of these strings is longer than INT_MAX bytes.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
The sqlite3-ruby maintainers have evaluated this as medium severity (CVSS 4.8). Exploitation requires an attacker to get at least 4 GiB into a single SQL string or bound value. Most deployments reject a request body that large before the application sees it, and the server must hold several copies of the string in memory.
A truncated bound value is only a prefix of the attacker's input, so the bind paths matter only where the application validated the full value. A truncated SQL string is more serious: when the attacker's input is inlined into the SQL, the clauses that follow it are dropped. If a dropped clause contained a bind placeholder, binding raises SQLite3::RangeException instead of running the query.
Upgrade to sqlite3 v2.10.2 or later.
As a workaround for earlier versions, reject SQL strings and bound values of 4 GiB or larger before passing them to sqlite3-ruby, or limit request body size well below 4 GiB.
This issue was responsibly reported by Luke Jahnke from elttam.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.