CVE-2026-128084: sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

sqlite3-ruby cast Ruby string lengths (long) to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the query, for example dropping a trailing WHERE clause. The affected paths are:

• the SQL passed to Database#prepare, #execute, and related methods
• String and Blob values passed to Statement#bind_param and related methods
• String and Blob values returned from SQL functions and aggregates defined in Ruby (Database#create_function, #create_aggregate, and related methods)

sqlite3 v2.10.2 raises RangeError when any of these strings is longer than INT_MAX bytes.