CVE-2026-54619: SQLite3 Ruby Use-After-Free Vulnerability

CVE-2026-54619 Overview

CVE-2026-54619 is a use-after-free vulnerability [CWE-416] in the sqlite3 Ruby gem, which provides Ruby bindings for the SQLite3 embedded database. The flaw exists in versions 2.9.4 and earlier. When a Ruby application redefines a SQLite user-defined function with a different arity, the library frees the previously registered function handler while the underlying SQLite engine may still hold a reference to it. Subsequent invocation of the stale reference triggers use-after-free behavior. The issue is fixed in version 2.9.5.

Critical Impact

Local, low-privilege exploitation of custom SQLite function registration can trigger memory corruption in Ruby applications embedding the sqlite3 gem.

Affected Products

• sqlite3 Ruby gem versions 2.9.4 and earlier
• Ruby applications using SQLite3::Database#create_function with redefinition
• Downstream distributions bundling the vulnerable sqlite3-ruby package

Discovery Timeline

• 2026-07-28 - CVE-2026-54619 published to NVD
• 2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-54619

Vulnerability Analysis

The sqlite3 Ruby gem allows applications to register custom SQL functions through SQLite3::Database#create_function. Internally, the library stored these Ruby block references inside an instance variable hash keyed by function name. When the same function name was registered again with a different arity, the previous hash entry was overwritten. This dropped the last Ruby-side reference to the earlier block, allowing garbage collection to reclaim it. However, the SQLite C library retained a pointer to the original callback handler through its own function registration table. Any subsequent invocation of the stale callback dereferences freed memory.

Root Cause

The root cause is a lifetime mismatch between Ruby object references and SQLite's internal function registry. Storing function handlers in a hash keyed by name did not account for SQLite's per-arity function registration semantics. Overwriting the hash entry released the Ruby block prematurely while SQLite still referenced its handler.

Attack Vector

Exploitation requires local access and the ability to influence function registration within a Ruby process using the vulnerable gem. An attacker capable of triggering redefinition of a custom SQLite function with a changed arity can cause the process to reference freed memory, resulting in memory corruption or a crash. The attack complexity is high and impact is limited to the local process context.

// Patch: ext/sqlite3/database.c
// Store function blocks in an array to preserve GC references
    CHECK(ctx->db, status);

-    rb_hash_aset(rb_iv_get(self, "@functions"), name, block);
+    rb_ary_push(rb_iv_get(self, "@functions"), block);

    return self;
}
// Source: https://github.com/sparklemotion/sqlite3-ruby/commit/2bd436d17f77cdd4c31b00fe9d50b0d21cbaf033

# Patch: lib/sqlite3/database.rb
# Initialize @functions as an array to retain all handlers
      @authorizer = nil
      @progress_handler = nil
      @collations = {}
-      @functions = {}
+      @functions = []
      @results_as_hash = options[:results_as_hash]
      @readonly = mode & Constants::Open::READONLY != 0
      @default_transaction_mode = options[:default_transaction_mode] || :deferred
# Source: https://github.com/sparklemotion/sqlite3-ruby/commit/2bd436d17f77cdd4c31b00fe9d50b0d21cbaf033

Detection Methods for CVE-2026-54619

Indicators of Compromise

• Unexpected segmentation faults or crashes in Ruby processes that use SQLite3::Database#create_function
• Application logs showing repeated calls to create_function with the same name and varying arity
• Core dumps referencing addresses within freed Ruby heap regions during SQLite callback execution

Detection Strategies

• Inventory Ruby applications and identify installed versions of the sqlite3 gem using bundle list or gem list sqlite3
• Perform static code review for patterns that redefine SQLite functions dynamically at runtime
• Run the application under memory sanitizers such as AddressSanitizer during testing to catch use-after-free conditions

Monitoring Recommendations

• Monitor Ruby application crash frequency and correlate with database function registration events
• Alert on abnormal process terminations tied to workers embedding sqlite3-ruby
• Track gem inventory drift across environments to catch unpatched deployments

How to Mitigate CVE-2026-54619

Immediate Actions Required

• Upgrade the sqlite3 Ruby gem to version 2.9.5 or later in all affected applications
• Rebuild and redeploy any container images or artifacts that bundle the vulnerable gem
• Audit application code for dynamic redefinition of custom SQLite functions and remove where unnecessary

Patch Information

The fix is available in sqlite3-ruby version 2.9.5. Review the GitHub Security Advisory GHSA-28hh-pr2h-2w89, the Pull Request #710, the remediation commit, and the v2.9.5 release notes.

Workarounds

• Avoid redefining custom SQLite functions with different arities during application runtime
• Restrict local access to hosts running Ruby applications backed by sqlite3-ruby until patched
• Pin dependency versions in Gemfile.lock to enforce the fixed release across deployments

# Upgrade the sqlite3 gem to the patched version
bundle update sqlite3 --conservative
gem list sqlite3
# Verify installed version is >= 2.9.5