Executive brief
The sqlite3-ruby library, which allows Ruby applications to interact with SQLite databases, contains a memory management flaw. If an application attempts to use a specific type of database calculation (an aggregate function) after the database connection has been closed, the application may crash or behave unpredictably. This could lead to service instability or a denial-of-service condition for the affected application.
Technical details
A use-after-free vulnerability (CWE-416) exists in the sqlite3-ruby gem between versions 2.1.0 and 2.9.4. The issue occurs when aggregate functions defined via Database#create_aggregate, #create_aggregate_handler, or #define_aggregator are referenced by an open statement after the database has undergone a 'soft' close. This results in the underlying callbacks being freed while still referenced, leading to invalid memory reads and segmentation faults. The vulnerability is typically triggered following garbage collection. A fix is available in version 2.9.5.
Affected products
- sparklemotion sqlite3-ruby >= 2.1.0, <= 2.9.4
Timeline
- 2026-06-07: patched: Fixed in version 2.9.5
- 2026-06-07: advisory: GitHub Security Advisory GHSA-j7fr-3v8c-3qc3 published
- 2026-07-28: disclosed: CVE-2026-54620 published to NVD