sparklemotion sqlite3-ruby up to 2.10.1 SQL Binding Database#prepare numeric truncation error

Summaryinfo

A vulnerability was found in sparklemotion sqlite3-ruby up to 2.10.1. It has been declared as critical. The impacted element is the function Database#prepare of the component SQL Binding. The manipulation results in numeric truncation error. This vulnerability was named CVE-2026-128084. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in sparklemotion sqlite3-ruby up to 2.10.1. Affected is the function Database#prepare of the component SQL Binding. The manipulation with an unknown input leads to a numeric truncation error vulnerability. CWE is classifying the issue as CWE-197. Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Database#prepare, bound String or Blob values through Statement#bind_param, and String or Blob results from Ruby-defined SQL functions and aggregates through Database#create_function and Database#create_aggregate. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger can wrap the length so SQLite processes only a prefix. A truncated SQL string can drop trailing clauses such as a WHERE condition, while a truncated bound value matters only when the application validated the full value before binding it. Exploitation requires the application and server to accept and retain the unusually large attacker-controlled string. If a dropped SQL clause contained a bind placeholder, binding raises SQLite3::RangeException instead of running the query. This issue is fixed in version 2.10.2.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-128084 since 11/12/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 2.10.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• sparklemotion

Name

• sqlite3-ruby

Version

• 2.10.0
• 2.10.1

Website

• Product: https://github.com/sparklemotion/sqlite3-ruby/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion