Loading...
Skip to main content
GeekWala

CVE-2026-54619

LOW

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

Published July 28, 2026Updated July 28, 2026Source: osv

Summary

## Summary Using `Database#create_function` or `Database#define_function` to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault. ## Mitigation Upgrade to sqlite3 gem v2.9.5 or later. As a workaround, avoid defining multiple custom functions with the same name (varying numbers of arguments or encoding). ## Severity The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update sqlite3 to 2.9.5 or later
gem install sqlite3 -v 2.9.5
Bundler
Update sqlite3-ruby to 2.9.5 or later
gem install sqlite3-ruby -v 2.9.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

PackageEcosystemAffectedFixed In
sqlite3
rubygems
0.0.0, 0.0.1, 0.0.2, 0.0.3 (+79 more)2.9.5
sqlite3-ruby
rubygems
0.5.0, 0.6.0, 0.9.0, 1.0.0 (+15 more)2.9.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 4.5 score means for each attack dimension.

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-54619?
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity This vulnerability has been assigned a severity rating of LOW (CVSS score: 4.5/10).
How do I check if my project is affected by CVE-2026-54619?
CVE-2026-54619 affects sqlite3 and sqlite3-ruby. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-54619 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
4.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-28hh-pr2h-2w89

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies