{"affected":[{"product":"sqlite3-ruby","source":"CNA: GitHub_M","vendor":"sparklemotion","versions":[{"status":"affected","version":"< 2.10.2"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"sqlite3","product":"sqlite3","source":"OSV GHSA-4fqr-96q8-xrfx","vendor":"","versions":[{"status":"affected","version":"0.0.0","versionType":"RubyGems"},{"status":"affected","version":"0.0.1","versionType":"RubyGems"},{"status":"affected","version":"0.0.2","versionType":"RubyGems"},{"status":"affected","version":"0.0.3","versionType":"RubyGems"},{"status":"affected","version":"0.0.4","versionType":"RubyGems"},{"status":"affected","version":"0.0.5","versionType":"RubyGems"},{"status":"affected","version":"0.0.6","versionType":"RubyGems"},{"status":"affected","version":"0.0.7","versionType":"RubyGems"},{"status":"affected","version":"0.0.8","versionType":"RubyGems"},{"status":"affected","version":"0.1.0","versionType":"RubyGems"},{"status":"affected","version":"0.1.1","versionType":"RubyGems"},{"status":"affected","version":"1.3.10","versionType":"RubyGems"},{"status":"affected","version":"1.3.11","versionType":"RubyGems"},{"status":"affected","version":"1.3.12","versionType":"RubyGems"},{"status":"affected","version":"1.3.13","versionType":"RubyGems"},{"status":"affected","version":"1.3.3","versionType":"RubyGems"},{"status":"affected","version":"1.3.3.beta.1","versionType":"RubyGems"},{"status":"affected","version":"1.3.4","versionType":"RubyGems"},{"status":"affected","version":"1.3.5","versionType":"RubyGems"},{"status":"affected","version":"1.3.6","versionType":"RubyGems"},{"status":"affected","version":"1.3.7","versionType":"RubyGems"},{"status":"affected","version":"1.3.8","versionType":"RubyGems"},{"status":"affected","version":"1.3.9","versionType":"RubyGems"},{"status":"affected","version":"1.4.0","versionType":"RubyGems"},{"status":"affected","version":"1.4.1","versionType":"RubyGems"},{"status":"affected","version":"1.4.2","versionType":"RubyGems"},{"status":"affected","version":"1.4.3","versionType":"RubyGems"},{"status":"affected","version":"1.4.4","versionType":"RubyGems"},{"status":"affected","version":"1.5.0","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.5.1","versionType":"RubyGems"},{"status":"affected","version":"1.5.2","versionType":"RubyGems"},{"status":"affected","version":"1.5.3","versionType":"RubyGems"},{"status":"affected","version":"1.5.4","versionType":"RubyGems"},{"status":"affected","version":"1.6.0","versionType":"RubyGems"},{"status":"affected","version":"1.6.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.6.0.rc2","versionType":"RubyGems"},{"status":"affected","version":"1.6.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.2","versionType":"RubyGems"},{"status":"affected","version":"1.6.3","versionType":"RubyGems"},{"status":"affected","version":"1.6.4","versionType":"RubyGems"},{"status":"affected","version":"1.6.5","versionType":"RubyGems"},{"status":"affected","version":"1.6.5.rc1","versionType":"RubyGems"},{"status":"affected","version":"1.6.6","versionType":"RubyGems"},{"status":"affected","version":"1.6.7","versionType":"RubyGems"},{"status":"affected","version":"1.6.8","versionType":"RubyGems"},{"status":"affected","version":"1.6.9","versionType":"RubyGems"},{"status":"affected","version":"1.7.0","versionType":"RubyGems"},{"status":"affected","version":"1.7.1","versionType":"RubyGems"},{"status":"affected","version":"1.7.2","versionType":"RubyGems"},{"status":"affected","version":"1.7.3","versionType":"RubyGems"},{"status":"affected","version":"2.0.0","versionType":"RubyGems"},{"status":"affected","version":"2.0.1","versionType":"RubyGems"},{"status":"affected","version":"2.0.2","versionType":"RubyGems"},{"status":"affected","version":"2.0.3","versionType":"RubyGems"},{"status":"affected","version":"2.0.4","versionType":"RubyGems"},{"status":"affected","version":"2.1.0","versionType":"RubyGems"},{"status":"affected","version":"2.1.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"2.1.0.rc2","versionType":"RubyGems"},{"status":"affected","version":"2.1.0.rc3","versionType":"RubyGems"},{"status":"affected","version":"2.1.1","versionType":"RubyGems"},{"status":"affected","version":"2.10.0","versionType":"RubyGems"},{"status":"affected","version":"2.10.1","versionType":"RubyGems"},{"status":"affected","version":"2.2.0","versionType":"RubyGems"},{"status":"affected","version":"2.3.0","versionType":"RubyGems"},{"status":"affected","version":"2.3.1","versionType":"RubyGems"},{"status":"affected","version":"2.4.0","versionType":"RubyGems"},{"status":"affected","version":"2.4.1","versionType":"RubyGems"},{"status":"affected","version":"2.5.0","versionType":"RubyGems"},{"status":"affected","version":"2.5.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"2.6.0","versionType":"RubyGems"},{"status":"affected","version":"2.7.0","versionType":"RubyGems"},{"status":"affected","version":"2.7.1","versionType":"RubyGems"},{"status":"affected","version":"2.7.2","versionType":"RubyGems"},{"status":"affected","version":"2.7.3","versionType":"RubyGems"},{"status":"affected","version":"2.7.4","versionType":"RubyGems"},{"status":"affected","version":"2.8.0","versionType":"RubyGems"},{"status":"affected","version":"2.8.1","versionType":"RubyGems"},{"status":"affected","version":"2.9.0","versionType":"RubyGems"},{"status":"affected","version":"2.9.1","versionType":"RubyGems"},{"status":"affected","version":"2.9.2","versionType":"RubyGems"},{"status":"affected","version":"2.9.2.rc2","versionType":"RubyGems"},{"status":"affected","version":"2.9.3","versionType":"RubyGems"},{"status":"affected","version":"2.9.4","versionType":"RubyGems"},{"status":"affected","version":"2.9.5","versionType":"RubyGems"},{"status":"affected","version":"2.9.6","versionType":"RubyGems"},{"events":[{"introduced":"0"},{"fixed":"2.10.2"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-128084","cwes":["CWE-681"],"description":"sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Database#prepare, bound String or Blob values through Statement#bind_param, and String or Blob results from Ruby-defined SQL functions and aggregates through Database#create_function and Database#create_aggregate. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger can wrap the length so SQLite processes only a prefix. A truncated SQL string can drop trailing clauses such as a WHERE condition, while a truncated bound value matters only when the application validated the full value before binding it. Exploitation requires the application and server to accept and retain the unusually large attacker-controlled string. If a dropped SQL clause contained a bind placeholder, binding raises SQLite3::RangeException instead of running the query. This issue is fixed in version 2.10.2.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.8,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794597305631,"publishedAt":1794595642594,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-4fqr-96q8-xrfx"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sparklemotion/sqlite3-ruby/pull/762"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sparklemotion/sqlite3-ruby/commit/41059aa3ccc2c0f910d6df4fccfe36b3c3c6c649"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.10.2"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-4fqr-96q8-xrfx"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-4fqr-96q8-xrfx"}],"remediation":[{"kind":"fix","source":"OSV GHSA-4fqr-96q8-xrfx","text":"sqlite3 (RubyGems): OSV reports a fixed version 2.10.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-4fqr-96q8-xrfx"}],"revision":"cbcd9b251caa49e825be6f84a96c2679bf5823cca52690c29fbdf208620d9972","sources":[{"modifiedAt":1794595642594,"name":"CNA: GitHub_M","retrievedAt":1794597922203,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128084"},{"modifiedAt":1794597305631,"name":"OSV / GitHub Security Advisories","retrievedAt":1794597922852,"url":"https://osv.dev/vulnerability/GHSA-4fqr-96q8-xrfx"}],"ssvc":null,"status":"published","title":"sqlite3-ruby: SQL Query Truncation","updatedAt":1794597922852}