CVE-2026-54620

lowcovered by 2 sourcesfirst seen 2026-07-28

Summary Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault. Mitigation Upgrade to sqlite3 gem v2.9.5 or later. As a workaround, avoid using an aggregate function after closing the database. Severity The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

⚡ Watch CVE-2026-54620

Get an email if CVE-2026-54620 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.

Advisory coverage (2)

unknownCVE-2026-54620: sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the cal…nvd · 2026-07-28
lowGHSA-j7fr-3v8c-3qc3: sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacksghsa · 2026-07-28

External references

NVD record for CVE-2026-54620

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-54620 status](https://www.csirts.com/badge/CVE-2026-54620)](https://www.csirts.com/cve/CVE-2026-54620)