Ghost Sqlite3 vulnerabilities

CVE-2025-29088 [MEDIUM] CVE-2025-29088: In SQLite 3 In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.

CVE-2026-54619 [LOW] CWE-416 sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity ## Summary Using `Database#create_function` or `Database#define_function` to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault. ## Mitigation Upgrade to sqlite3 gem v2.9.5 or

CVE-2026-54620 [LOW] CWE-416 sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks ## Summary Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault. ## Mitigation Upgrad

CVE-2025-52099 [MEDIUM] CVE-2025-52099: Integer Overflow vulnerability in SQLite SQLite3 v Integer Overflow vulnerability in SQLite SQLite3 v.3.50.0 allows a remote attacker to cause a denial of service via the setupLookaside function