CVE-2026-54620: SQLite3 Ruby Use-After-Free Vulnerability

CVE-2026-54620 Overview

CVE-2026-54620 is a use-after-free vulnerability [CWE-416] in the sqlite3 Ruby gem, which provides Ruby bindings for the SQLite3 embedded database. The flaw exists in the callback handling for SQLite aggregate functions. Callbacks can be freed while still referenced during aggregation, leading to memory corruption. The issue affects versions 2.1.0 through 2.9.4 and is fixed in version 2.9.5.

Critical Impact
Local, low-privileged attackers who can influence aggregate function usage may trigger memory corruption in the Ruby process, potentially causing crashes or undefined behavior.

Affected Products

sqlite3-ruby gem versions 2.1.0 through 2.9.4
Ruby applications using Database#create_aggregate or related aggregate function APIs
Downstream Ruby applications embedding the affected sqlite3 gem

Discovery Timeline

2026-07-28 - CVE CVE-2026-54620 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-54620

Vulnerability Analysis

The sqlite3 Ruby gem allows developers to register aggregate functions via Ruby callback blocks. These callbacks are invoked by the underlying SQLite C library during query aggregation. In affected versions, the gem cleared its internal reference to the aggregator objects prematurely, allowing Ruby's garbage collector to free callback objects that SQLite still held references to. When SQLite later invoked the freed callback, the process accessed freed memory. This use-after-free condition can crash the interpreter or produce undefined behavior depending on memory reuse patterns.

Root Cause

The root cause lies in ext/sqlite3/database.c, where the instance variable -aggregators was set to Qnil during database close or discard operations. This removed the last Ruby-side reference to the aggregator objects while SQLite retained function pointers. Without the anchoring reference, the Ruby garbage collector could reclaim the callbacks. The fix retains the block reference for the lifetime of the database object, ensuring the callback remains valid whenever SQLite invokes it.

Attack Vector

Exploitation requires local access with low privileges and the ability to influence Ruby code paths that register or invoke aggregate functions. The attack complexity is high because triggering the free during active aggregation depends on garbage collection timing. Impact is limited to the Ruby process context executing the SQLite query.

// Security patch in ext/sqlite3/database.c
// Removes premature clearing of aggregator references

     close_or_discard_db(ctx);
 
-    rb_iv_set(self, "-aggregators", Qnil);
-
     return self;
 }

Source: GitHub Commit b24e1e6

ruby

# Documentation update in lib/sqlite3/database.rb
# Clarifies block lifetime guarantee

     # function invocation. It should invoke FunctionProxy#result= to
     # store the result of the function.
     #
+    # A reference to the block will be kept for the lifetime of the database object.
     #
     # Example:
     #
     #   db.create_aggregate( "lengths", 1 ) do

Source: GitHub Commit b24e1e6

Detection Methods for CVE-2026-54620

Indicators of Compromise

Unexpected segmentation faults or SIGSEGV crashes in Ruby processes using the sqlite3 gem
Ruby crash logs referencing sqlite3_aggregate or rb_sqlite3_func frames
Abnormal termination of long-running Ruby workers that execute queries with GROUP BY or custom aggregates

Detection Strategies

Inventory Ruby applications and their Gemfile.lock entries to identify sqlite3 gem versions between 2.1.0 and 2.9.4
Audit source code for calls to Database#create_aggregate and Database#define_aggregator to identify exposed code paths
Monitor process exit codes and core dumps for Ruby workloads that interact with SQLite

Monitoring Recommendations

Track dependency manifests in CI/CD pipelines to flag vulnerable sqlite3 gem versions before deployment
Enable Ruby process crash reporting to capture stack traces referencing SQLite aggregate callbacks
Correlate application error telemetry with SQLite query patterns that invoke aggregate functions

How to Mitigate CVE-2026-54620

Immediate Actions Required

Upgrade the sqlite3 gem to version 2.9.5 or later across all Ruby applications
Regenerate and commit updated Gemfile.lock files after upgrading
Restart Ruby application processes to load the patched library into memory

Patch Information

The fix is available in sqlite3-ruby version 2.9.5, released via GitHub Release v2.9.5. The corresponding code change is documented in Pull Request #711 and detailed in the GHSA-j7fr-3v8c-3qc3 Security Advisory. The patch retains the aggregator reference for the lifetime of the database object, preventing premature garbage collection.

Workarounds

Avoid using Database#create_aggregate and Database#define_aggregator until the gem is upgraded
Manually retain a strong reference to aggregator blocks in application code to prevent garbage collection
Restrict local access to systems running vulnerable Ruby applications while patching is in progress

bash

# Upgrade the sqlite3 gem to the patched release
bundle update sqlite3 --conservative

# Verify the installed version is 2.9.5 or later
bundle list | grep sqlite3

# Alternatively, pin the minimum safe version in the Gemfile
# gem "sqlite3", ">= 2.9.5"