Rusqlite is a widely embedded Rust binding for SQLite that provides a common interface to SQLite databases across many downstream Rust applications, making vulnerabilities in the library consequential beyond its own release cycle. Its vulnerabilities skew strongly toward critical-severity outcomes and recur across memory-safety and synchronization weakness classes such as use-after-free conditions, race conditions, and format-string issues that reflect the safety boundaries between Rust and C FFI layers. Defenders should prioritize inventory of applications that depend on this library and treat its security advisories as supply-chain critical, since remediation requires downstream rebuild and deployment; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Rusqlite Project over time
Signals from CVEs in this vendor scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-35869CRITICAL An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings. | Dec 31, 2020 | 9.8 | 30 | NO | NO |
CVE-2020-35872CRITICAL An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type. | Dec 31, 2020 | 9.8 | 29 | NO | NO |
CVE-2020-35868CRITICAL An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via UnlockNotification. | Dec 31, 2020 | 9.8 | 29 | NO | NO |
CVE-2020-35867CRITICAL An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module. | Dec 31, 2020 | 9.8 | 29 | NO | NO |
CVE-2020-35866CRITICAL An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor. | Dec 31, 2020 | 9.8 | 29 | NO | NO |
CVE-2020-35873CRITICAL An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free. | Dec 31, 2020 | 9.8 | 28 | NO | NO |
CVE-2021-45719HIGH An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. update_hook has a use-after-free. | Dec 26, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-45718HIGH An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollback_hook has a use-after-free. | Dec 26, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-45716HIGH An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free. | Dec 26, 2021 | 7.5 | 25 | NO | NO |
CVE-2021-45715HIGH An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_window_function has a use-after-free. | Dec 26, 2021 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (15 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Rusqlite Project.
Media articles that mention a CVE ID that affects a product developed by Rusqlite Project — matched by CVE ID, not by vendor name.