Loading...
Skip to main content
GeekWala

CVE-2026-54619 — Vulnerability in sqlite3 — CVE Details

LOW

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

Published July 28, 2026Updated July 28, 2026Source: osv

Summary

## Summary Using `Database#create_function` or `Database#define_function` to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault. ## Mitigation Upgrade to sqlite3 gem v2.9.5 or later. As a workaround, avoid defining multiple custom functions with the same name (varying numbers of arguments or encoding). ## Severity The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Advisory Timeline

  • First published July 28, 2026 (76 days ago).
  • Last revised July 28, 2026 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update sqlite3 to 2.9.5 or later
gem install sqlite3 -v 2.9.5
Bundler
Update sqlite3-ruby to 2.9.5 or later
gem install sqlite3-ruby -v 2.9.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: rubygems (2).

PackageEcosystemAffectedFixed In
sqlite3
rubygems
0.0.0, 0.0.1, 0.0.2, 0.0.3 (+79 more)2.9.5
sqlite3-ruby
rubygems
0.5.0, 0.6.0, 0.9.0, 1.0.0 (+15 more)2.9.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 4.5 score means for each attack dimension.

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-54619?
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity This vulnerability has been assigned a severity rating of LOW (CVSS score: 4.5/10).
How do I check if my project is affected by CVE-2026-54619?
CVE-2026-54619 affects sqlite3 and sqlite3-ruby. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-54619 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
4.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-28hh-pr2h-2w89

Related CVEs

  • GHSA-mwm8-39rw-8826
    MEDIUM

    sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array

  • CVE-2026-73492
    LOW

    Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

  • CVE-2026-73491
    LOW

    Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

  • CVE-2026-54620
    LOW

    sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies