Every CVE Search/ Get API key

CVE-2026-54620

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

2.0 LowFix available

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.14%Unchanged since Jul 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.0

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Record
CVE-2026-54620
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-49899 2.0

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Record
EUVD-2026-49899
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-j7fr-3v8c-3qc3 2.0

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Summary

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid using an aggregate function after closing the database.

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Record
GHSA-j7fr-3v8c-3qc3
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
NVD 2.0

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Record
CVE-2026-54620
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-416
Updated
2026-11-02
OSV 2.0

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Record
CVE-2026-54620
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-54620 2.0

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Record
DEBIAN-CVE-2026-54620
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVGHSA-j7fr-3v8c-3qc3 2.0

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Summary

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid using an aggregate function after closing the database.

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Record
GHSA-j7fr-3v8c-3qc3
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
OSVUBUNTU-CVE-2026-54620 2.0

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Record
UBUNTU-CVE-2026-54620
CVSS 4.0
2.0 LowCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sqlite3-ruby
RubyGems
 2.1.0 to 2.9.4
2.9.5
sqlite3
RubyGems
 2.1.0 to 2.9.4
2.9.5
ruby-sqlite3
Debian:12
 All versions, plus listed versions
1.4.2-41.6.9-11.6.9-21.7.3-11.7.3-2
Show 8 moreShow less
2.10.0-1~exp12.9.0-12.9.1-12.9.3-12.9.5-12.9.5-22.9.6-12.9.6-2
 None known
ruby-sqlite3
Debian:13
 All versions, plus listed versions
1.7.3-11.7.3-22.10.0-1~exp12.9.0-12.9.1-1
Show 5 moreShow less
2.9.3-12.9.5-12.9.5-22.9.6-12.9.6-2
 None known
ruby-sqlite3
Debian:14
 before 2.9.5-1, plus listed versions
1.7.3-11.7.3-22.9.0-12.9.1-12.9.3-1
2.9.5-1
sqlite3-ruby
RubyGems
 2.1.0 up to 2.9.5
2.9.5
sqlite3
RubyGems
 2.1.0 up to 2.9.5, plus listed versions
2.1.12.2.02.3.02.3.12.4.0
Show 17 moreShow less
2.4.12.5.02.5.0.rc12.6.02.7.02.7.12.7.22.7.32.7.42.8.02.8.12.9.02.9.12.9.22.9.2.rc22.9.32.9.4
2.9.5
ruby-sqlite3
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.3.10-11.3.11-11.3.11-1build11.3.11-21.3.11-2build1
 None known
ruby-sqlite3
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.3.13-11.3.13-1build11.3.13-1build2
 None known
ruby-sqlite3
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.3.13-1build21.4.2-2build1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
ruby-sqlite3
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.2-31.4.2-3build11.4.2-4
 None known
ruby-sqlite3
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.4.2-4build21.4.2-4build31.4.2-4build4
 None known
ruby-sqlite3
Ubuntu:26.10
 All versions, plus listed versions
1.7.3-22.9.5-2
 None known
ruby-sqlite3
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.7.3-11.7.3-2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54620 is a low vulnerability (CVSS 2.0) in Sparklemotion Sqlite3-ruby, published July 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in sqlite3-ruby 2.9.5.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open