CVE-2026-54619
published 2026-07-28CVE-2026-54619: sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the…
PriorityP412low2CVSS 4.0
AVLACHATNPRLUINVCLVILVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.11%
1.2th percentile
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ghost | sqlite3 | >= 0 < 2.9.5 | 2.9.5 |
| satellite_el8 | rubygem-sqlite3 | — | — |
| sparklemotion | sqlite3-ruby | < 2.9.5 | 2.9.5 |
| sparklemotion | sqlite3-ruby | >= 0 < 2.9.5 | 2.9.5 |
CVSS provenance
nvdv4.02.0LOWCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
sqlite3-ruby: sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity
vendor_redhat·2026-07-28·CVSS 2.0
CVE-2026-54619 [LOW] CWE-825 sqlite3-ruby: sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity
sqlite3-ruby: sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.
A flaw was found in sqlite3-ruby. When a SQLite function is redefined with a different number of arguments (arity), the previously registered function handler is prematurely freed. This can lead to a use-after-free vulnerability, where the program attempts to access memory that has already been released. Such a vulnerability could potentially result in unexpected program behavior, infor
GHSA
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
ghsa·2026-07-28
CVE-2026-54619 [LOW] CWE-416 sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
## Summary
Using `Database#create_function` or `Database#define_function` to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.
## Mitigation
Upgrade to sqlite3 gem v2.9.5 or later.
As a workaround, avoid defining multiple custom functions with the same name (varying numbers of arguments or encoding).
## Severity
The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-54619 rubygem-sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity [fedora-all]
bugzilla·2026-08-06·CVSS 2.0
CVE-2026-54619 [LOW] CVE-2026-54619 rubygem-sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity [fedora-all]
CVE-2026-54619 rubygem-sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Bugzilla
CVE-2026-54619 rubygem-sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity [epel-all]
bugzilla·2026-08-06·CVSS 2.0
CVE-2026-54619 [LOW] CVE-2026-54619 rubygem-sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity [epel-all]
CVE-2026-54619 rubygem-sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Bugzilla
CVE-2026-54619 sqlite3-ruby: sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity
bugzilla·2026-07-28·CVSS 2.0
CVE-2026-54619 [LOW] CVE-2026-54619 sqlite3-ruby: sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity
CVE-2026-54619 sqlite3-ruby: sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.
2026-07-28
Published