Vulnerability Description
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Related Weaknesses (CWE)
References
- https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a8
- https://github.com/sparklemotion/sqlite3-ruby/pull/711
- https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5
- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c
FAQ
What is CVE-2026-54620?
CVE-2026-54620 is a documented vulnerability. sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulti...
How severe is CVE-2026-54620?
CVSS scoring is not yet available for CVE-2026-54620. Check NVD for updates.
Is there a patch for CVE-2026-54620?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.