{"id":"RUSTSEC-2026-0138","aliases":[],"status":"published","title":"Unsound access to padding bytes while serializing date/time values using the Mysql backend","description":"Diesel-async uses the mysql-async crate for interacting with Mysql compatible databases. This library already provides access to deserialized data for date/time releated types. Diesel-async then translated these deserialized data back to their serialized binary representation to hook into diesels desearialization framework.\n\nWhile serializing these data/time values again Diesel-async relied on a cast between the `MysqlTime` `#[repr(C)]` struct (defined by Diesel) and a byte array. As this cast exposes padding bytes contained in this struct, this is undefined behaviour.\n\nThis vulnerability affects any user deserializing date/time values using the Mysql backend and diesel-async.\n\nThis affects any usage of the following functions with a `AsyncMysqlConnection` provided by diesel-async:\n\n* `diesel::serialize::FromSql\u003cTimestamp, Mysql\u003e`\n* `diesel::serialize::FromSql\u003cTime, Mysql\u003e`\n* `diesel::serialize::FromSql\u003cDate, Mysql\u003e`\n* `diesel::serialize::FromSql\u003cDateTime, Mysql\u003e`\n\n\n## Mitigation\n\nThe preferred mitigation to the outlined problem is to update to Diesel-async version 0.9.0 or newer, which includes fixes for the problem.\n\n## Resolution\n\nDiesel-async now just calls a safe serialization method provided by Diesel 2.3.9 and newer","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-04-30T12:00:00Z","modified":"2026-05-13T14:32:26Z","fixes":[{"ecosystem":"crates.io","package":"diesel-async","fixed_in":["0.9.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"diesel-async","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.9.0"}]}]}],"references":[{"url":"https://crates.io/crates/diesel-async","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0138.html","tags":["advisory"]},{"url":"https://github.com/diesel-rs/diesel_async/security/advisories/GHSA-ff9q-rm55-q7qr","tags":["advisory"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0138","title":"Unsound access to padding bytes while serializing date/time values using the Mysql backend","description":"Diesel-async uses the mysql-async crate for interacting with Mysql compatible databases. This library already provides access to deserialized data for date/time releated types. Diesel-async then translated these deserialized data back to their serialized binary representation to hook into diesels desearialization framework.\n\nWhile serializing these data/time values again Diesel-async relied on a cast between the `MysqlTime` `#[repr(C)]` struct (defined by Diesel) and a byte array. As this cast exposes padding bytes contained in this struct, this is undefined behaviour.\n\nThis vulnerability affects any user deserializing date/time values using the Mysql backend and diesel-async.\n\nThis affects any usage of the following functions with a `AsyncMysqlConnection` provided by diesel-async:\n\n* `diesel::serialize::FromSql\u003cTimestamp, Mysql\u003e`\n* `diesel::serialize::FromSql\u003cTime, Mysql\u003e`\n* `diesel::serialize::FromSql\u003cDate, Mysql\u003e`\n* `diesel::serialize::FromSql\u003cDateTime, Mysql\u003e`\n\n\n## Mitigation\n\nThe preferred mitigation to the outlined problem is to update to Diesel-async version 0.9.0 or newer, which includes fixes for the problem.\n\n## Resolution\n\nDiesel-async now just calls a safe serialization method provided by Diesel 2.3.9 and newer","status":"published","published":"2026-04-30T12:00:00Z","modified":"2026-05-13T14:32:26.46418Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}