---
id: "CVE-2026-128084"
page: "https://infrastack.ai/live/CVE-2026-128084"
kind: "vulnerability"
aliases: ["CVE-2026-128084", "GHSA-4fqr-96q8-xrfx"]
title: "sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "sqlite3", "fixed": ["2.10.2"], "affected": "<= 2.10.1", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-681", "package", "ruby", "rubygems", "sqlite3-ruby"]
not_affected_if: ["request-size-limit-below-4gib", "sqlite3-ruby-2.10.2-or-later"]
published_at: "2026-11-13T18:57:58+00:00"
first_seen_at: "2026-11-13T18:58:25+00:00"
updated_at: "2026-11-13T18:59:41+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-4fqr-96q8-xrfx", "first_seen_at": "2026-11-13T18:58:25+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128084", "first_seen_at": "2026-11-13T19:52:09+00:00"}]
exploit_sources: []
---

# sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Link for people: https://infrastack.ai/live/CVE-2026-128084 (this .md is for agents)

sqlite3-ruby cast string lengths to int, so strings of 4 GiB or more wrap and SQLite reads only a prefix. An attacker who controls a very long SQL string can make the query drop trailing clauses such as a WHERE.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:sqlite3 affected <= 2.10.1 fixed 2.10.2

## How to check

- Check the installed gem version with `gem list sqlite3` or `bundle list`; versions `2.10.1` and earlier are affected.
- Look for applications that build SQL from request data or accept request bodies that can reach 4 GiB.

## Fix

- sqlite3-ruby: upgrade to `2.10.2` or later.
- Workaround for earlier versions per the advisory: reject SQL strings and bound values of 4 GiB or larger before passing them to sqlite3-ruby, or limit request body size well below 4 GiB.

## Timeline

- 2026-11-13T18:58:25+00:00 ghsa https://github.com/advisories/GHSA-4fqr-96q8-xrfx
- 2026-11-13T19:52:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128084

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/sparklemotion/sqlite3-ruby/security-advisories/GHSA-4fqr-96q8-xrfx
- [advisory] Maintainer's advisory: github.com https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-4fqr-96q8-xrfx
- [fix] Patch: github.com https://github.com/sparklemotion/sqlite3-ruby/pull/762
- [fix] Patch: github.com https://github.com/sparklemotion/sqlite3-ruby/commit/41059aa3ccc2c0f910d6df4fccfe36b3c3c6c649
- [fix] Release: github.com https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.10.2

## From the sources

### Summary

sqlite3-ruby cast Ruby string lengths (`long`) to `int` before passing them to SQLite. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger had its length wrap, so SQLite saw only the first `length mod 2^32` bytes. An attacker who controls the length of a SQL string could truncate the query, for example dropping a trailing `WHERE` clause. The affected paths are:

- the SQL passed to `Database#prepare`, `#execute`, and related methods
- String and Blob values passed to `Statement#bind_param` and related methods
- String and Blob values returned from SQL functions and aggregates defined in Ruby (`Database#create_function`, `#create_aggregate`, and related methods)

sqlite3 v2.10.2 raises `RangeError` when any of these strings is longer than `INT_MAX` bytes.

### Severity

The sqlite3-ruby maintainers have evaluated this as medium severity (CVSS 4.8). Exploitation requires an attacker to get at least 4 GiB into a single SQL string or bound value. Most deployments reject a request body that large before the application sees it, and the server must hold several copies of the string in memory.

A truncated bound value is only a prefix of the attacker's input, so the bind paths matter only where the application validated the full value. A truncated SQL string is more serious: when the attacker's input is inlined into the SQL, the clauses that follow it are dropped. If a dropped clause contained a bind placeholder, binding raises `SQLite3::RangeException` instead of running the query.

### Mitigation

Upgrade to sqlite3 v2.10.2 or later.

As a workaround for earlier versions, reject SQL strings and bound values of 4 GiB or larger before passing them to sqlite3-ruby, or limit request body size well below 4 GiB.

### Credit

This issue was responsibly reported by Luke Jahnke from elttam.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_