PT-2026-65657 · Rubygems · Sqlite3+1

Publicado 2026-07-28 · Atualizado 2026-07-28

OSV

CVSS v4.0

2.0

Baixa

Vetor base

AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Summary

Using Database#create aggregate, #create aggregate handler, or Database#define aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid using an aggregate function after closing the database.

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

GHSA-J7FR-3V8C-3QC3

Produtos afetados

Sqlite3

Sqlite3-Ruby

Referências · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sqlite3/CVE-2026-54620.yml · Exploit
• https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5 · Nota
• https://github.com/sparklemotion/sqlite3-ruby/pull/711 · Nota
• https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3 · Nota
• https://github.com/sparklemotion/sqlite3-ruby · Nota
• https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726 · Nota
• https://cve.org/CVERecord/SearchResults?query=CVE-2026-54620 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-j7fr-3v8c-3qc3 · Aviso do Fabricante