CVE-2026-54620: sparklemotion sqlite3-ruby use-after-free in aggregate function callbacks

CVE-2026-54620 · Severity: medium · CVSS 4 · Published 2026-07-28

The sqlite3-ruby library, which allows Ruby applications to interact with SQLite databases, contains a memory management flaw. If an application attempts to use a specific type of database calculation (an aggregate function) after the database connection has been closed, the application may crash or behave unpredictably. This could lead to service instability or a denial-of-service condition for the affected application.

Technologies: sqlite3 (RubyGems), sqlite3-ruby (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-54620 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54620 being exploited in the wild.
How severe is CVE-2026-54620?
Medium severity, with a CVSS score of 4, published 28 July 2026.
Which products and versions are affected?
sqlite3 (RubyGems) >= 2.1.0, <= 2.9.4, ECOSYSTEM:introduced=2.1.0,fixed=2.9.5; sqlite3-ruby (RubyGems) >= 2.1.0, <= 2.9.4, ECOSYSTEM:introduced=2.1.0,fixed=2.9.5.
Is there a fix for CVE-2026-54620?
Yes. sqlite3 (RubyGems): upgrade to 2.9.5 or later; sqlite3-ruby (RubyGems): upgrade to 2.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54620 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-54620?
Check whether you run sqlite3 (RubyGems) or sqlite3-ruby (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sqlite3 (RubyGems): upgrade to 2.9.5 or later
    bundle update sqlite3
  • sqlite3-ruby (RubyGems): upgrade to 2.9.5 or later
    bundle update sqlite3-ruby

Technical details

A use-after-free vulnerability (CWE-416) exists in the sqlite3-ruby gem between versions 2.1.0 and 2.9.4. The issue occurs when aggregate functions defined via Database#create_aggregate, #create_aggregate_handler, or #define_aggregator are referenced by an open statement after the database has undergone a 'soft' close. This results in the underlying callbacks being freed while still referenced, leading to invalid memory reads and segmentation faults. The vulnerability is typically triggered following garbage collection. A fix is available in version 2.9.5.

Affected products

  • sparklemotion sqlite3-ruby >= 2.1.0, <= 2.9.4

Identifiers

  • CVE-2026-54620
  • GHSA-j7fr-3v8c-3qc3

Timeline

  • 2026-06-07: patched: Fixed in version 2.9.5
  • 2026-06-07: advisory: GitHub Security Advisory GHSA-j7fr-3v8c-3qc3 published
  • 2026-07-28: disclosed: CVE-2026-54620 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.