Use-After-Free Vulnerability in SQLite3 Ruby Bindings
CVE-2026-54620

2LOW

Key Information:

Vendor

Sparklemotion

Status
Sqlite3-ruby
Vendor
CVE Published:
28 July 2026

What is CVE-2026-54620?

The SQLite3 Ruby bindings, versions 2.1.0 to 2.9.4, contain a critical vulnerability where callbacks utilized for SQLite aggregate functions can be released while still being referenced. This leads to a use-after-free condition, which may result in unpredictable behavior or potential exploitation in applications relying on this library for database management. Users are advised to update to version 2.9.5 or later to mitigate this vulnerability.

Affected Version(s)

sqlite3-ruby >= 2.1.0, < 2.9.5

References

https://github.com/sparklemotion/sqlite3-ruby/security/ad...
x_refsource_CONFIRM
https://github.com/sparklemotion/sqlite3-ruby/pull/711
x_refsource_MISC
https://github.com/sparklemotion/sqlite3-ruby/commit/b24e...
x_refsource_MISC

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.