Login Request a demo
Low severity · published Jul 28, 2026
CVE-2026-54620
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
2.0
CVSS
0.1%
EPSS
No
On KEV
Description
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
sqlite3-ruby · sparklemotion
>= 2.1.0, < 2.9.5 · source: vendor
Affected product
SQ
sqlite3-ruby
sparklemotion
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-54620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-54620
github.com
https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726
github.com
https://github.com/sparklemotion/sqlite3-ruby/pull/711
github.com
https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5
github.com
https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3
More from sqlite3-ruby
2.0
CVE-2026-54619
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity