sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Summary sqlite3-ruby cast Ruby string lengths long to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB 2^32 bytes or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the quer...

GHSA-4FQR-96Q8-XRFX sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Summary sqlite3-ruby cast Ruby string lengths long to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB 2^32 bytes or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the quer...

CVE-2026-128084

sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Databaseprepare, bound String or Blob values through Statementbindparam, and String or Blob results from Ruby-defined SQL functions and...

CVE-2026-128084 sqlite3-ruby: SQL Query Truncation

sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Databaseprepare, bound String or Blob values through Statementbindparam, and String or Blob results from Ruby-defined SQL functions and...