{"id":"CVE-2020-35871","aliases":["EUVD-2021-1870","GHSA-28ph-f7gx-fqj8","GHSA-3cgf-9m6x-pwwr","GHSA-6q5w-m3c5-rv95","GHSA-8h4j-vm3r-vcq3","GHSA-8r7q-r9mx-35rh","GHSA-g4w7-3qr8-5623","GHSA-q3cc-7p7g-392c","GHSA-rjh8-p66p-jrh5","RUSTSEC-2020-0014"],"status":"published","title":"Data races in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01035,"percentile":0.64111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134","CWE-351","CWE-362","CWE-416"],"published":"2020-04-23T12:00:00Z","modified":"2026-10-20T10:54:20Z","fixes":[{"ecosystem":"crates.io","package":"rusqlite","fixed_in":["0.23.0"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"bundled":8},{"source":"osv","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"bundled":8},{"source":"osv","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"bundled":8},{"source":"osv","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"bundled":8},{"source":"osv","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"bundled":8},{"source":"osv","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"bundled":8},{"source":"osv","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"bundled":8},{"source":"osv","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.23.0"}]}],"bundled":8},{"source":"osv","ecosystem":"crates.io","package":"rusqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.23.0"}]}],"bundled":8}],"products":[{"vendor":"rusqlite_project","product":"rusqlite"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2020-0014.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/rusqlite/rusqlite/releases/tag/0.23.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35871","tags":["advisory"]},{"url":"https://github.com/rusqlite/rusqlite/commit/2ef3628dac35aeba0a97d5fb3a57746b4e1d62b3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rjh8-p66p-jrh5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35867","tags":["advisory"]},{"url":"https://github.com/rusqlite/rusqlite/commit/3c6b57fe1b2cc87e7ebecde43dd836ffb1c4ea5c","tags":["web"]},{"url":"https://github.com/rusqlite/rusqlite","tags":["package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35868","tags":["advisory"]},{"url":"https://github.com/rusqlite/rusqlite/commit/45fd77ee43c38eea4d6f4e2e56c1667a55ec654f","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35866","tags":["advisory"]},{"url":"https://github.com/rusqlite/rusqlite/commit/c9ef5bd63cad5c0c123344c072b490a1a9bcbe1f","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35869","tags":["advisory"]},{"url":"https://github.com/rusqlite/rusqlite/commit/2327d3b774927fdf48903c0bdc1ca7ec93c7c8d0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35872","tags":["advisory"]},{"url":"https://github.com/rusqlite/rusqlite/commit/71b2f5187b0cbace3f8b6ff53432ff2ca0defcf0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35873","tags":["advisory"]},{"url":"https://github.com/rusqlite/rusqlite/commit/ac30e169ae51b262bc8cf7026469851ce39b23c6","tags":["web"]},{"url":"https://crates.io/crates/rusqlite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-35871","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.","status":"published","published":"2020-12-31T08:28:15Z","modified":"2024-08-04T17:16:12.991Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2021-1870","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.","status":"published","published":"2020-12-31T08:28:15Z","modified":"2024-08-04T17:16:12Z","updated_at":"2026-11-03T03:07:04.595509Z"}],"ghsa":[{"id":"GHSA-rjh8-p66p-jrh5","title":"Data races in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.","status":"published","published":"2021-08-25T20:46:59Z","modified":"2023-06-13T20:45:27Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:36:54.225318Z"}],"nvd":[{"id":"CVE-2020-35871","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.","status":"published","published":"2020-12-31T10:15:15.583Z","modified":"2026-06-17T03:14:30.293Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"CVE-2020-35866","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor.","status":"published","published":"2020-12-31T10:15:15.27Z","modified":"2026-11-09T10:45:19.661279546Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"CVE-2020-35867","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.","status":"published","published":"2020-12-31T10:15:15.333Z","modified":"2026-11-09T10:45:19.658296822Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"CVE-2020-35868","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification.","status":"published","published":"2020-12-31T10:15:15.393Z","modified":"2026-11-09T10:45:19.656661713Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"CVE-2020-35869","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.","status":"published","published":"2020-12-31T10:15:15.457Z","modified":"2026-10-20T10:54:20.226546028Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"CVE-2020-35870","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.","status":"published","published":"2020-12-31T10:15:15.503Z","modified":"2026-10-20T10:54:20.334728342Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"CVE-2020-35871","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.","status":"published","published":"2020-12-31T10:15:15.583Z","modified":"2026-10-20T10:53:26.766075031Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"CVE-2020-35872","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type.","status":"published","published":"2020-12-31T10:15:15.627Z","modified":"2026-10-20T10:53:26.792135226Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"CVE-2020-35873","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free.","status":"published","published":"2020-12-31T10:15:15.69Z","modified":"2026-10-20T10:53:26.792587883Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"GHSA-28ph-f7gx-fqj8","title":"Data races in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.","status":"published","published":"2021-08-25T20:47:57Z","modified":"2024-03-15T00:05:20.03373Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"GHSA-3cgf-9m6x-pwwr","title":"Data races in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification.","status":"published","published":"2021-08-25T20:47:50Z","modified":"2024-03-15T00:05:20.03373Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"GHSA-6q5w-m3c5-rv95","title":"Data races in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor.","status":"published","published":"2021-08-25T20:47:59Z","modified":"2024-03-15T00:05:20.03373Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"GHSA-8h4j-vm3r-vcq3","title":"Use after free in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.","status":"published","published":"2021-08-25T20:47:48Z","modified":"2024-03-15T00:05:20.03373Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"GHSA-8r7q-r9mx-35rh","title":"Mishandling of format strings in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.","status":"published","published":"2021-08-25T20:47:18Z","modified":"2024-03-15T00:05:20.03373Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"GHSA-g4w7-3qr8-5623","title":"Improper type usage in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type.","status":"published","published":"2021-08-25T20:47:01Z","modified":"2024-03-15T00:05:20.03373Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-351"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"GHSA-q3cc-7p7g-392c","title":"Use after free in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free.","status":"published","published":"2021-08-25T20:47:43Z","modified":"2024-03-15T00:05:20.03373Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"GHSA-rjh8-p66p-jrh5","title":"Data races in rusqlite","description":"An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.","status":"published","published":"2021-08-25T20:46:59Z","modified":"2024-03-15T00:05:20.03373Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:55.877614Z"},{"id":"RUSTSEC-2020-0014","title":"Various memory safety issues","description":"Several memory safety issues have been uncovered in an audit of\nrusqlite.\n\nSee https://github.com/rusqlite/rusqlite/releases/tag/0.23.0 for a complete list.","status":"published","published":"2020-04-23T12:00:00Z","modified":"2024-03-15T00:05:20.03373Z","updated_at":"2026-11-02T15:53:39.492624Z"}]}}