# CVE-2026-54620: sparklemotion sqlite3-ruby use-after-free in aggregate function callbacks

Source: https://junglewise.ai/threats/cve-2026-54620-sparklemotion-sqlite3-ruby-use-after-free-in-aggregate-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-54620 · Severity: medium · CVSS 4 · Published 2026-07-28

The sqlite3-ruby library, which allows Ruby applications to interact with SQLite databases, contains a memory management flaw. If an application attempts to use a specific type of database calculation (an aggregate function) after the database connection has been closed, the application may crash or behave unpredictably. This could lead to service instability or a denial-of-service condition for the affected application.

Technologies: [sqlite3 (RubyGems)](https://junglewise.ai/threats/technologies/sqlite3), [sqlite3-ruby (RubyGems)](https://junglewise.ai/threats/technologies/sqlite3-ruby). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-54620 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54620 being exploited in the wild.

**How severe is CVE-2026-54620?** Medium severity, with a CVSS score of 4, published 28 July 2026.

**Which products and versions are affected?** sqlite3 (RubyGems) >= 2.1.0, <= 2.9.4, ECOSYSTEM:introduced=2.1.0,fixed=2.9.5; sqlite3-ruby (RubyGems) >= 2.1.0, <= 2.9.4, ECOSYSTEM:introduced=2.1.0,fixed=2.9.5.

**Is there a fix for CVE-2026-54620?** Yes. sqlite3 (RubyGems): upgrade to 2.9.5 or later; sqlite3-ruby (RubyGems): upgrade to 2.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54620 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-54620?** Check whether you run sqlite3 (RubyGems) or sqlite3-ruby (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sqlite3 (RubyGems): upgrade to 2.9.5 or later

  ```sh
  bundle update sqlite3
  ```

- sqlite3-ruby (RubyGems): upgrade to 2.9.5 or later

  ```sh
  bundle update sqlite3-ruby
  ```


## Technical details

A use-after-free vulnerability (CWE-416) exists in the sqlite3-ruby gem between versions 2.1.0 and 2.9.4. The issue occurs when aggregate functions defined via Database#create_aggregate, #create_aggregate_handler, or #define_aggregator are referenced by an open statement after the database has undergone a 'soft' close. This results in the underlying callbacks being freed while still referenced, leading to invalid memory reads and segmentation faults. The vulnerability is typically triggered following garbage collection. A fix is available in version 2.9.5.

## Affected products

- sparklemotion sqlite3-ruby >= 2.1.0, <= 2.9.4

## Identifiers

- CVE-2026-54620
- GHSA-j7fr-3v8c-3qc3

## Timeline

- 2026-06-07: patched: Fixed in version 2.9.5
- 2026-06-07: advisory: GitHub Security Advisory GHSA-j7fr-3v8c-3qc3 published
- 2026-07-28: disclosed: CVE-2026-54620 published to NVD

## References

- [https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726](https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726)
- [https://github.com/sparklemotion/sqlite3-ruby/pull/711](https://github.com/sparklemotion/sqlite3-ruby/pull/711)
- [https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5](https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5)
- [https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3](https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3)

## Related threats

- [sqlite3-ruby use-after-free in aggregate function arguments](https://junglewise.ai/threats/sqlite3-ruby-use-after-free-in-sqlite-aggregate-arguments-in-heap-01570321)
- [sparklemotion sqlite3-ruby use-after-free in function redefinition](https://junglewise.ai/threats/cve-2026-54619-sparklemotion-sqlite3-ruby-use-after-free-in-function)
- [SQLite3 addresses vulnerability in packaged version of libsqlite](https://junglewise.ai/threats/sqlite3-addresses-vulnerability-in-packaged-version-of-libsqlite-99a0560a)
- [sqlite3-ruby uses weak permissions for unspecified files, which allows local users to gain privileges](https://junglewise.ai/threats/cve-2011-0995-sqlite3-ruby-uses-weak-permissions-for-unspecified-files-which)