Description
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Published: 2026-07-28
Score: 2 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

sqlite3-ruby provides Ruby bindings for SQLite. In versions 2.9.4 and earlier, redefining a SQLite function with a different number of arguments frees the previously registered function handler while SQLite may still hold a reference, creating a use‑after‑free that can corrupt memory and typically results in a crash or unpredictable behavior. This weakness is classified as CWE-416 and CWE-825 and poses a denial of service risk.

Affected Systems

The flaw affects all installations of the sparklemotion sqlite3‑ruby gem at version 2.9.4 or older. The vulnerability was fixed in release 2.9.5.

Risk and Exploitability

The CVSS score is 2, indicating low severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation is very low. Based on the description, it is inferred that no publicly known exploits exist. The likely attack vector is local, requiring an adversary who can run arbitrary Ruby code in the affected application to trigger a redefinition that differs in arity and provoke an application crash.

Generated by OpenCVE AI on August 7, 2026 at 01:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the sqlite3‑ruby gem to version 2.9.5 or later
  • If an upgrade is not possible, avoid redefining SQLite functions at runtime or ensure that any redefinitions use the same arity as originally registered
  • Limit or sandbox Ruby code that can manipulate SQLite function definitions to prevent potential crash scenarios

Generated by OpenCVE AI on August 7, 2026 at 01:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-28hh-pr2h-2w89 sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
History

Fri, 07 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.5, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L'}

threat_severity

Moderate

Wed, 29 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Sparklemotion
Sparklemotion sqlite3-ruby
Vendors & Products Sparklemotion
Sparklemotion sqlite3-ruby

Tue, 28 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Description sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.
Title sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
Weaknesses CWE-416
References
Metrics cvssV4_0

{'score': 2, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Sparklemotion Sqlite3-ruby
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-28T19:33:33.444Z

Reserved: 2026-06-15T20:07:02.184Z

Link: CVE-2026-54619

cve-icon Vulnrichment

Updated: 2026-07-28T19:33:30.338Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-07-28T17:16:52.650

Modified: 2026-07-30T19:31:43.780

Link: CVE-2026-54619

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-28T16:21:20Z

Links: CVE-2026-54619 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T01:30:04Z

Weaknesses