RUSTSEC-2026-0134 Unsound access to padding bytes while serializing date/time values using the Mysql backend
Unsound memory access in Diesel's MySQL backend allows reading padding bytes, potentially leaking sensitive data during date/time serialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0134?
RUSTSEC-2026-0134 is a memory corruption vulnerability in diesel, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Diesel relies on libmysqlclient for interacting with Mysql compatible databases. This library requires to provide date/time values according to the byte layout of their MYSQL_TIME type.
Diesel replicated this type as #[repr(C)] struct, populated all the fields of this struct and then casted this value to an array of bytes. As this cast exposes padding bytes contained in this struct, this is undefined behaviour.
This vulnerability affects any user serializing date/time values using the Mysql backend.
Mitigation
The preferred mitigation to the outlined problem is to update to Diesel version 2.3.8 or newer, which includes fixes for the problem.
Resolution
Diesel now manually serializes the relevant data without accessing the padding bytes.
Which versions are affected by RUSTSEC-2026-0134?
1 open source package ship an affected version, including diesel.
| Package | Affected | Fixed in |
|---|---|---|
diesel crates.io | From 0.0.0-0 | 2.3.8 |
How do I fix RUSTSEC-2026-0134?
Upgrade diesel to 2.3.8 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is RUSTSEC-2026-0134 being exploited?
There is no known exploitation of RUSTSEC-2026-0134 in the wild and no public exploit code.