Back to overview

CVE-2026-54620

LOW
2.0
CVSS 4.0
Description
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5.

Metadata

CVE ID
CVE-2026-54620
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-15 20:07 UTC
Published
2026-07-28 16:23 UTC
Last updated
2026-07-28 17:27 UTC
Primary CWE
CWE-416
CWE-416: Use After Free
Vendor / Product
sparklemotion / sqlite3-ruby
Sources
cve.org  ·  NVD

Severity & Metrics

2.0 LOW CVSS 4.0
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
sparklemotion sqlite3-ruby — >= 2.1.0, < 2.9.5
Weakness (CWE)
CWESourceDescription
CWE-416 cna CWE-416: Use After Free
CVSS scores (1)
ScoreSeverityVersionSourceVector
2.0 LOW 4.0 cna CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
References (4)
Back to overview