Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-28T16:23:38 sqlite3-ruby: sqlite3: sqlite3-ruby: Use-After-Free vulnerability in SQLite aggregate function callbacks 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L CWE-825

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

A flaw was found in sqlite3-ruby, a Ruby binding for the SQLite3 embedded database. This vulnerability occurs because callbacks used for SQLite aggregate functions can be prematurely freed while still being referenced during aggregation. A local attacker could potentially exploit this use-after-free condition to cause unpredictable application behavior, which may lead to information disclosure or a denial of service (DoS).

Red Hat Satellite 6 Not affected rubygem-sqlite3 Red Hat Satellite 6 Not affected satellite:el8/rubygem-sqlite3 https://www.cve.org/CVERecord?id=CVE-2026-54620 https://nvd.nist.gov/vuln/detail/CVE-2026-54620 https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726 https://github.com/sparklemotion/sqlite3-ruby/pull/711 https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5 https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3