Loading...
Skip to main content
GeekWala

CVE-2026-54620

LOW

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Published July 28, 2026Updated July 28, 2026Source: osv

Summary

## Summary Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault. ## Mitigation Upgrade to sqlite3 gem v2.9.5 or later. As a workaround, avoid using an aggregate function after closing the database. ## Severity The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update sqlite3 to 2.9.5 or later
gem install sqlite3 -v 2.9.5
Bundler
Update sqlite3-ruby to 2.9.5 or later
gem install sqlite3-ruby -v 2.9.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

PackageEcosystemAffectedFixed In
sqlite3
rubygems
2.1.0, 2.1.1, 2.2.0, 2.3.0 (+19 more)2.9.5
sqlite3-ruby
rubygems
All versions2.9.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 4.5 score means for each attack dimension.

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-54620?
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks This vulnerability has been assigned a severity rating of LOW (CVSS score: 4.5/10).
How do I check if my project is affected by CVE-2026-54620?
CVE-2026-54620 affects sqlite3 and sqlite3-ruby. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-54620 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
4.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-j7fr-3v8c-3qc3

Related CVEs

  • CVE-2026-54619
    LOW

    sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

  • CVE-2026-61866
    LOW

    ImageMagick: Memory Leak in JNG encoder when a blob could not be opened

  • CVE-2026-61871
    LOW

    ImageMagick: Memory Leak in ICON decoder when allocation fails

  • CVE-2026-61872
    LOW

    ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified

  • CVE-2026-61868
    LOW

    ImageMagick: Memory Leak in YUV decoder when opening of blob fails

  • CVE-2026-61867
    LOW

    ImageMagick: Memory Leak in TIFF encoder when an allocation fails

  • CVE-2026-61870
    LOW

    ImageMagick: Memory leak in VIFF encoder when allocation fails

  • CVE-2026-61869
    LOW

    ImageMagick: Memory Leak in MIFF encoder when allocaton fails

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies