CVE-2026-128084

### Summary sqlite3-ruby cast Ruby string lengths (`long`) to `int` before passing them to SQLite. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger had its length wrap, so SQLite saw only the first `length mod 2^32` bytes. An attacker who controls the length of a SQL string could truncate the query, for example dropping a trailing `WHERE` clause. The affected paths are: - the SQL passed to `Database#prepare`, `#execute`, and related methods - String and Blob values passed to `Statement#bind_param` and related methods - String and Blob values returned from SQL functions and aggregates defined in Ruby (`Database#create_function`, `#create_aggregate`, and related methods) sqlite3 v2.10.2 raises `RangeError` when any of these strings is longer than `INT_MAX` bytes. ### Severity The sqlite3-ruby maintainers have evaluated this as medium severity (CVSS 4.8). Exploitation requires an attacker to get at least 4 GiB into a single SQL string or bound value. Most deployments reject a request body that large before the application sees it, and the server must hold several copies of the string in memory. A truncated bound value is only a prefix of the attacker's input, so the bind paths matter only where the application validated the full value. A truncated SQL string is more serious: when the attacker's input is inlined into the SQL, the clauses that follow it are dropped. If a dropped clause contained a bind placeholder, binding raises `SQLite3::RangeException` instead of running the query. ### Mitigation Upgrade to sqlite3 v2.10.2 or later. As a workaround for earlier versions, reject SQL strings and bound values of 4 GiB or larger before passing them to sqlite3-ruby, or limit request body size well below 4 GiB. ### Credit This issue was responsibly reported by Luke Jahnke from elttam.