CVE-2026-54620
published 2026-07-28CVE-2026-54620: sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while…
PriorityP410low2CVSS 4.0
AVLACHATNPRLUINVCLVILVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.11%
1.2th percentile
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ghost | sqlite3 | >= 2.1.0 < 2.9.5 | 2.9.5 |
| satellite_el8 | rubygem-sqlite3 | — | — |
| sparklemotion | sqlite3-ruby | — | — |
| sparklemotion | sqlite3-ruby | >= 2.1.0 < 2.9.5 | 2.9.5 |
CVSS provenance
nvdv4.02.0LOWCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
sqlite3-ruby: sqlite3: sqlite3-ruby: Use-After-Free vulnerability in SQLite aggregate function callbacks
vendor_redhat·2026-07-28·CVSS 2.0
CVE-2026-54620 [LOW] CWE-825 sqlite3-ruby: sqlite3: sqlite3-ruby: Use-After-Free vulnerability in SQLite aggregate function callbacks
sqlite3-ruby: sqlite3: sqlite3-ruby: Use-After-Free vulnerability in SQLite aggregate function callbacks
A flaw was found in sqlite3-ruby, a Ruby binding for the SQLite3 embedded database. This vulnerability occurs because callbacks used for SQLite aggregate functions can be prematurely freed while still being referenced during aggregation. A local attacker could potentially exploit this use-after-free condition to cause unpredictable application behavior, which may lead to information disclosure or a denial of service (DoS).
Package: rubygem-sqlite3 (Red Hat Satellite 6) - Under investigation
Package: satellite:el8/rubygem-sqlite3 (Red Hat Satellite 6) - Under investigation
GHSA
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
ghsa·2026-07-28
CVE-2026-54620 [LOW] CWE-416 sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
## Summary
Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.
## Mitigation
Upgrade to sqlite3 gem v2.9.5 or later.
As a workaround, avoid using an aggregate function after closing the database.
## Severity
The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.
No detection rules found.
No public exploits indexed.
2026-07-28
Published