CVE-2026-54620 Details
Description
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.
A use-after-free vulnerability has been identified in the sqlite3 Ruby gem, specifically in versions 2.1.0 prior to 2.9.4. This vulnerability arises in the callbacks for SQLite aggregate functions, which can be freed while still being referenced during aggregation. The issue can lead to invalid memory access and a segmentation fault, particularly when an open statement calling an aggregate function is used after the database has been closed. The vulnerability is triggered after garbage collection, under certain conditions.
Upgrade to sqlite3 Ruby gem version 2.9.5 or later. As a temporary workaround, avoid using aggregate functions after closing the database.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |