Executive brief
The sqlite3-ruby library, which allows Ruby applications to interact with SQLite databases, contains a memory management flaw. When a developer redefines a custom database function with a different number of arguments, the library may incorrectly free memory that is still in use. This can lead to application crashes (segmentation faults) or unpredictable behavior, potentially impacting the reliability of services using this library.
Technical details
A use-after-free vulnerability exists in the Ruby bindings for SQLite3 (sqlite3-ruby) within the `Database#create_function` and `Database#define_function` methods. When a function is redefined with a different arity (number of arguments) or text encoding, the library frees the previously registered function handler while the underlying SQLite engine may still maintain a reference to it. This occurs because the handler's lifecycle is not correctly synchronized with SQLite's internal state. An attacker or a specific code execution flow can trigger this after garbage collection, resulting in a segmentation fault or memory corruption. The issue is fixed in version 2.9.5.
Affected products
- sparklemotion sqlite3-ruby <= 2.9.4
Timeline
- 2026-06-07: patched: Version 2.9.5 released
- 2026-06-07: advisory: GitHub Security Advisory GHSA-28hh-pr2h-2w89 published
- 2026-07-28: disclosed: CVE-2026-54619 published to NVD