Описание
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
Summary
Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.
Mitigation
Upgrade to sqlite3 gem v2.9.5 or later.
As a workaround, avoid using an aggregate function after closing the database.
Severity
The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.
Ссылки
- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3
- https://github.com/sparklemotion/sqlite3-ruby/pull/711
- https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sqlite3/CVE-2026-54620.yml
- https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54620
Пакеты
sqlite3-ruby
>= 2.1.0, <= 2.9.4
2.9.5
sqlite3
>= 2.1.0, <= 2.9.4
2.9.5
Связанные уязвимости
(sqlite3 provides Ruby bindings for the SQLite3 embedded database. From ...)
A flaw was found in sqlite3-ruby, a Ruby binding for the SQLite3 embedded database. This vulnerability occurs because callbacks used for SQLite aggregate functions can be prematurely freed while still being referenced during aggregation. A local attacker could potentially exploit this use-after-free condition to cause unpredictable application behavior, which may lead to information disclosure or a denial of service (DoS).
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From ...