GHSA-j7fr-3v8c-3qc3: sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

lowCVE-2026-54620

Summary Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault. Mitigation Upgrade to sqlite3 gem v2.9.5 or later. As a workaround, avoid using an aggregate function after closing the database. Severity The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Details

Source: GitHub Security Advisories (INTL · database · site)
Severity: low
Published: 2026-07-28
Last updated: 2026-07-28
Exploitation: Not in CISA KEV at last sync

Original advisory: https://github.com/advisories/GHSA-j7fr-3v8c-3qc3

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-546200.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-54620	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownCVE-2026-54620: sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the cal…nvd

GHSA-j7fr-3v8c-3qc3: sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Details

Exploitation outlook

Referenced CVEs

Same CVEs, other sources

More from GitHub Security Advisories