Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, published 2 October 2026.
- Which products and versions are affected?
- sqlite3 (RubyGems) >= 1.4.0, <= 2.9.5; Sqlite3 1.4.0 through 2.9.5.
- Is there a fix for This vulnerability?
- Yes: fixed in sqlite3 2.9.6. Until then: If you cannot upgrade, avoid defining aggregate functions that take two or more arguments. Restricting column value sizes is not a reliable mitigation as it only reduces the defect frequency without preventing it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run sqlite3 (RubyGems) or Sqlite3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: sqlite3 2.9.6
If you cannot upgrade, avoid defining aggregate functions that take two or more arguments. Restricting column value sizes is not a reliable mitigation as it only reduces the defect frequency without preventing it.
Technical details
A use-after-free vulnerability in sqlite3-ruby's aggregate function handling occurs when the Database#create_aggregate, #create_aggregate_handler, or #define_aggregator methods define functions accepting two or more arguments. During evaluation over TEXT or BLOB column values, Ruby objects holding arguments are freed during garbage collection before later arguments finish conversion, causing the step method to receive incorrect objects or triggering a segmentation fault. The vulnerability requires evaluating a multi-argument aggregate over attacker-influenced column data but has no demonstrated controlled memory write.
Affected products
- sqlite3 1.4.0 through 2.9.5
Timeline
- 2026-10-02: advisory