Most recent entries from all

EUVD-2026-342157

fkie_cve-2026-54620

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

GHSA-j7fr-3v8c-3qc3 — sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Affected: RubyGems: sqlite3-ruby, RubyGems: sqlite3

## Summary

Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

## Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid using an aggregate function after closing the database.

## Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

UBUNTU-CVE-2026-54620

Affected: Ubuntu:16.04:LTS: ruby-sqlite3, Ubuntu:18.04:LTS: ruby-sqlite3, Ubuntu:20.04:LTS: ruby-sqlite3, Ubuntu:22.04:LTS: ruby-sqlite3, Ubuntu:24.04:LTS: ruby-sqlite3, Ubuntu:26.04:LTS: ruby-sqlite3