{"id":"CVE-2026-128084","kind":"vulnerability","aliases":["CVE-2026-128084","GHSA-4fqr-96q8-xrfx"],"related":[],"title":"sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger","description":"### Summary\n\nsqlite3-ruby cast Ruby string lengths (`long`) to `int` before passing them to SQLite. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger had its length wrap, so SQLite saw only the first `length mod 2^32` bytes. An attacker who controls the length of a SQL string could truncate the query, for example dropping a trailing `WHERE` clause. The affected paths are:\n\n- the SQL passed to `Database#prepare`, `#execute`, and related methods\n- String and Blob values passed to `Statement#bind_param` and related methods\n- String and Blob values returned from SQL functions and aggregates defined in Ruby (`Database#create_function`, `#create_aggregate`, and related methods)\n\nsqlite3 v2.10.2 raises `RangeError` when any of these strings is longer than `INT_MAX` bytes.\n\n### Severity\n\nThe sqlite3-ruby maintainers have evaluated this as medium severity (CVSS 4.8). Exploitation requires an attacker to get at least 4 GiB into a single SQL string or bound value. Most deployments reject a request body that large before the application sees it, and the server must hold several copies of the string in memory.\n\nA truncated bound value is only a prefix of the attacker's input, so the bind paths matter only where the application validated the full value. A truncated SQL string is more serious: when the attacker's input is inlined into the SQL, the clauses that follow it are dropped. If a dropped clause contained a bind placeholder, binding raises `SQLite3::RangeException` instead of running the query.\n\n### Mitigation\n\nUpgrade to sqlite3 v2.10.2 or later.\n\nAs a workaround for earlier versions, reject SQL strings and bound values of 4 GiB or larger before passing them to sqlite3-ruby, or limit request body size well below 4 GiB.\n\n### Credit\n\nThis issue was responsibly reported by Luke Jahnke from elttam.","summary":"sqlite3-ruby cast string lengths to int, so strings of 4 GiB or more wrap and SQLite reads only a prefix. An attacker who controls a very long SQL string can make the query drop trailing clauses such as a WHERE.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sqlite3","fixed":["2.10.2"],"affected":"<= 2.10.1","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["cwe-681","package","ruby","rubygems","sqlite3-ruby"],"not_affected_if":["request-size-limit-below-4gib","sqlite3-ruby-2.10.2-or-later"],"how_to_check":"- Check the installed gem version with `gem list sqlite3` or `bundle list`; versions `2.10.1` and earlier are affected.\n- Look for applications that build SQL from request data or accept request bodies that can reach 4 GiB.","fix":"- sqlite3-ruby: upgrade to `2.10.2` or later.\n- Workaround for earlier versions per the advisory: reject SQL strings and bound values of 4 GiB or larger before passing them to sqlite3-ruby, or limit request body size well below 4 GiB.","status":"open","published_at":"2026-11-13T18:57:58+00:00","first_seen_at":"2026-11-13T18:58:25+00:00","triaged_at":"2026-11-13T18:59:41+00:00","updated_at":"2026-11-13T18:59:41+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-13T18:59:41Z","model":"claude-haiku-5-5","output":{"fix":"- sqlite3-ruby: upgrade to `2.10.2` or later.\n- Workaround for earlier versions per the advisory: reject SQL strings and bound values of 4 GiB or larger before passing them to sqlite3-ruby, or limit request body size well below 4 GiB.","reach":"network","title":"sqlite3-ruby: long SQL strings over 4 GiB get truncated before execution","impact":"medium","summary":"sqlite3-ruby cast string lengths to int, so strings of 4 GiB or more wrap and SQLite reads only a prefix. An attacker who controls a very long SQL string can make the query drop trailing clauses such as a WHERE.","audience":"developers","category":"package","nicknames":[],"who_cares":["ruby","sqlite3-ruby","rubygems"],"confidence":0.85,"fix_status":"available","needs_auth":"unknown","worst_case":"Query truncated, dropping trailing clauses such as WHERE filters","analyst_note":"","how_to_check":"- Check the installed gem version with `gem list sqlite3` or `bundle list`; versions `2.10.1` and earlier are affected.\n- Look for applications that build SQL from request data or accept request bodies that can reach 4 GiB.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["request-size-limit-below-4gib","sqlite3-ruby-2.10.2-or-later"],"who_is_affected":"Only applications that use sqlite3-ruby 2.10.1 or earlier on 64-bit platforms and that can receive or build SQL or bound values of 4 GiB or larger. The advisory says most deployments reject request bodies that large before the application sees them, and the server must hold several copies of the string in memory. Teams whose inputs are capped far below 4 GiB can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000856,"input_tokens":5237,"output_tokens":664,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128084':18A,26A '-2026':17A,25A '-681':29B '2':99C,116C '32':100C,117C '4':12A,47B,97C,224C,346C,364C '4.8':215C '4fqr':21A '64':91C '96q8':22A 'affect':141C 'aggreg':175C,183C 'applic':244C,280C 'attack':59B,120C,219C,269C,294C 'bind':161C,274C,315C,317C 'bit':92C 'blob':156C,168C 'bodi':239C,360C 'bound':232C,261C,343C 'byte':101C,118C,201C 'cast':39B,78C 'claus':73B,139C,303C,312C 'contain':313C 'control':61B,122C 'copi':253C 'could':129C 'creat':180C,182C 'credit':366C 'cve':16A,24A 'cvss':214C 'cwe':28B 'databas':148C,179C 'defin':176C 'deploy':235C 'drop':71B,135C,308C,311C 'earlier':337C 'elttam':376C 'evalu':209C 'exampl':134C 'execut':150C 'exploit':216C 'first':113C 'follow':305C 'full':283C 'function':173C,181C 'get':221C 'ghsa':20A 'ghsa-4fqr-96q8-xrfx':19A 'gib':13A,48B,98C,225C,347C,365C 'hold':251C 'inlin':298C 'input':271C,296C 'instead':321C 'int':43B,84C,199C 'issu':368C 'jahnk':374C 'larg':241C 'larger':15A,103C,349C 'later':332C 'least':223C 'length':41B,81C,106C,114C,124C 'limit':358C 'long':64B,82C 'longer':197C 'luke':373C 'maintain':207C 'make':68B 'matter':276C 'max':200C 'medium':212C 'memori':258C 'method':153C,165C,186C 'mitig':326C 'mod':115C 'must':250C 'packag':30B 'param':162C 'pass':86C,146C,158C,351C 'path':142C,275C 'placehold':316C 'platform':93C 'possibl':4A 'prefix':57B,266C 'prepar':149C 'queri':6A,70B,132C,325C 'rais':189C,318C 'rangeerror':190C 'rangeexcept':320C 'read':54B 'reject':236C,339C 'relat':152C,164C,185C 'report':371C 'request':238C,359C 'requir':217C 'respons':370C 'return':170C 'rubi':3A,31B,35B,38B,77C,79C,178C,206C,356C 'rubygem':32B 'run':323C 'saw':110C 'see':245C 'serious':291C 'server':249C 'sever':202C,213C,252C 'singl':228C 'size':361C 'sql':5A,65B,127C,145C,172C,229C,287C,301C,340C 'sqlite':53B,89C,109C 'sqlite3':2A,27A,34B,37B,76C,187C,205C,319C,329C,355C 'sqlite3-ruby':1A,33B,36B,75C,204C,354C 'statement':160C 'string':10A,40B,45B,66B,80C,95C,128C,154C,166C,195C,230C,256C,288C,341C 'summari':74C 'trail':72B,137C 'truncat':7A,130C,260C,286C 'upgrad':327C 'v2.10.2':188C,330C 'valid':281C 'valu':157C,169C,233C,262C,284C,344C 'version':338C 'well':362C 'workaround':335C 'wrap':51B,107C 'xrfx':23A","nicknames":[],"mitigations":[],"who_affected":"Only applications that use sqlite3-ruby 2.10.1 or earlier on 64-bit platforms and that can receive or build SQL or bound values of 4 GiB or larger. The advisory says most deployments reject request bodies that large before the application sees them, and the server must hold several copies of the string in memory. Teams whose inputs are capped far below 4 GiB can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["sqlite3"],"ptokens":["sqlite3"],"labels":["cwe681","medium","package","ruby","rubygems","sqlite3ruby"],"campaign_type":null,"search_a":"'-128084':18A,26A '-2026':17A,25A '4':12A '4fqr':21A '96q8':22A 'cve':16A,24A 'ghsa':20A 'ghsa-4fqr-96q8-xrfx':19A 'gib':13A 'larger':15A 'possibl':4A 'queri':6A 'rubi':3A 'sql':5A 'sqlite3':2A,27A 'sqlite3-ruby':1A 'string':10A 'truncat':7A 'xrfx':23A","search_b":"'-681':29B '4':47B 'attack':59B 'cast':39B 'claus':73B 'control':61B 'cwe':28B 'drop':71B 'gib':48B 'int':43B 'length':41B 'long':64B 'make':68B 'packag':30B 'prefix':57B 'queri':70B 'read':54B 'rubi':31B,35B,38B 'rubygem':32B 'sql':65B 'sqlite':53B 'sqlite3':34B,37B 'sqlite3-ruby':33B,36B 'string':40B,45B,66B 'trail':72B 'wrap':51B","search_c":"'2':99C,116C '32':100C,117C '4':97C,224C,346C,364C '4.8':215C '64':91C 'affect':141C 'aggreg':175C,183C 'applic':244C,280C 'attack':120C,219C,269C,294C 'bind':161C,274C,315C,317C 'bit':92C 'blob':156C,168C 'bodi':239C,360C 'bound':232C,261C,343C 'byte':101C,118C,201C 'cast':78C 'claus':139C,303C,312C 'contain':313C 'control':122C 'copi':253C 'could':129C 'creat':180C,182C 'credit':366C 'cvss':214C 'databas':148C,179C 'defin':176C 'deploy':235C 'drop':135C,308C,311C 'earlier':337C 'elttam':376C 'evalu':209C 'exampl':134C 'execut':150C 'exploit':216C 'first':113C 'follow':305C 'full':283C 'function':173C,181C 'get':221C 'gib':98C,225C,347C,365C 'hold':251C 'inlin':298C 'input':271C,296C 'instead':321C 'int':84C,199C 'issu':368C 'jahnk':374C 'larg':241C 'larger':103C,349C 'later':332C 'least':223C 'length':81C,106C,114C,124C 'limit':358C 'long':82C 'longer':197C 'luke':373C 'maintain':207C 'matter':276C 'max':200C 'medium':212C 'memori':258C 'method':153C,165C,186C 'mitig':326C 'mod':115C 'must':250C 'param':162C 'pass':86C,146C,158C,351C 'path':142C,275C 'placehold':316C 'platform':93C 'prefix':266C 'prepar':149C 'queri':132C,325C 'rais':189C,318C 'rangeerror':190C 'rangeexcept':320C 'reject':236C,339C 'relat':152C,164C,185C 'report':371C 'request':238C,359C 'requir':217C 'respons':370C 'return':170C 'rubi':77C,79C,178C,206C,356C 'run':323C 'saw':110C 'see':245C 'serious':291C 'server':249C 'sever':202C,213C,252C 'singl':228C 'size':361C 'sql':127C,145C,172C,229C,287C,301C,340C 'sqlite':89C,109C 'sqlite3':76C,187C,205C,319C,329C,355C 'sqlite3-ruby':75C,204C,354C 'statement':160C 'string':80C,95C,128C,154C,166C,195C,230C,256C,288C,341C 'summari':74C 'trail':137C 'truncat':130C,260C,286C 'upgrad':327C 'v2.10.2':188C,330C 'valid':281C 'valu':157C,169C,233C,262C,284C,344C 'version':338C 'well':362C 'workaround':335C 'wrap':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T21:35:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4fqr-96q8-xrfx","url":"https://github.com/advisories/GHSA-4fqr-96q8-xrfx","severity":"medium","published_at":"2026-11-13T18:57:58+00:00","modified_at":"2026-11-13T18:58:00+00:00","first_seen_at":"2026-11-13T18:58:25+00:00","fetched_at":"2026-11-13T19:04:12+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-128084","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128084","severity":null,"published_at":"2026-11-13T19:19:31+00:00","modified_at":"2026-11-13T19:19:31+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","fetched_at":"2026-11-13T19:52:10+00:00","note":null}],"documents":[{"id":148684,"url":"https://api.github.com/repos/sparklemotion/sqlite3-ruby/security-advisories/GHSA-4fqr-96q8-xrfx","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":148685,"url":"https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-4fqr-96q8-xrfx","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-10-26T21:35:59+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":148686,"url":"https://github.com/sparklemotion/sqlite3-ruby/pull/762","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148687,"url":"https://github.com/sparklemotion/sqlite3-ruby/commit/41059aa3ccc2c0f910d6df4fccfe36b3c3c6c649","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148688,"url":"https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.10.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}