CVE-2026-128084
Received Received - Intake

SQLite3 Ruby Bindings Integer Overflow in SQL Processing

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Database#prepare, bound String or Blob values through Statement#bind_param, and String or Blob results from Ruby-defined SQL functions and aggregates through Database#create_function and Database#create_aggregate. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger can wrap the length so SQLite processes only a prefix. A truncated SQL string can drop trailing clauses such as a WHERE condition, while a truncated bound value matters only when the application validated the full value before binding it. Exploitation requires the application and server to accept and retain the unusually large attacker-controlled string. If a dropped SQL clause contained a bind placeholder, binding raises SQLite3::RangeException instead of running the query. This issue is fixed in version 2.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128084
EUVD
EUVD-2026-125713

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-681 When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the sqlite3 Ruby gem before version 2.10.2. It involves incorrect handling of string lengths when passing SQL through Database#prepare, Statement#bind_param, and Database#create_function. On 64-bit systems, strings of 4 GiB or larger can wrap the length, causing SQLite to process only a prefix of the SQL string. This may truncate SQL clauses like WHERE conditions, potentially altering query behavior.

Detection Guidance

Detecting this vulnerability requires checking the version of sqlite3-ruby in use. Run gem list sqlite3 to see the installed version. If it is below 2.10.2, the system is vulnerable. Additionally, inspect applications for handling of large strings passed to SQLite queries or functions.

Impact Analysis

If exploited, this vulnerability could allow an attacker to manipulate SQL queries by truncating them, potentially bypassing security checks like WHERE conditions. This might lead to unauthorized data access or modification. Exploitation requires the application to accept and retain unusually large attacker-controlled strings.

Mitigation Strategies

Upgrade sqlite3-ruby to version 2.10.2 or later immediately. This can be done via gem install sqlite3 -v 2.10.2 or updating the Gemfile if using Bundler. Ensure no applications retain or process unusually large attacker-controlled strings before binding to SQLite.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...