Use After Free in Sparklemotion Sqlite3-Ruby
CVE-2026-54620
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Vulnerability class: Use-After-Free
EPSS: 0.001 (1.2th percentile) — read the EPSS interpretation.
Affected products
- Sparklemotion Sqlite3-ruby — versions >= 2.1.0, < 2.9.5
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)