https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T07:02:47.401136+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-342157 EUVD-2026-342157 2026-10-04T07:02:47.465948+00:00 EUVD-2026-342157 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54620 fkie_cve-2026-54620 2026-10-04T07:02:47.465987+00:00

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

 https://cve.radiocsirt.org/vuln/ghsa-j7fr-3v8c-3qc3 GHSA-j7fr-3v8c-3qc3 — sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks 2026-10-04T07:02:47.466020+00:00

Affected: RubyGems: sqlite3-ruby, RubyGems: sqlite3

## Summary

Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

## Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid using an aggregate function after closing the database.

## Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54620 UBUNTU-CVE-2026-54620 2026-10-04T07:02:47.466055+00:00

Affected: Ubuntu:16.04:LTS: ruby-sqlite3, Ubuntu:18.04:LTS: ruby-sqlite3, Ubuntu:20.04:LTS: ruby-sqlite3, Ubuntu:22.04:LTS: ruby-sqlite3, Ubuntu:24.04:LTS: ruby-sqlite3, Ubuntu:26.04:LTS: ruby-sqlite3

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.