Advisory Database
  • Advisories
  • Dependency Scanning
  1. gem
  2. ›
  3. sqlite3
  4. ›
  5. GHSA-mwm8-39rw-8826

GHSA-mwm8-39rw-8826: sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array

October 2, 2026

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function that takes two or more arguments, and then evaluating it over TEXT or BLOB column values, can free the Ruby objects holding those arguments while a later argument is still being converted, during ordinary garbage collection. The aggregate’s step method then receives an incorrect object, or the process crashes with a segmentation fault.

References

  • github.com/advisories/GHSA-mwm8-39rw-8826
  • github.com/sparklemotion/sqlite3-ruby/commit/cc5ac0cdf05af8148f4363410da0ba32508d9c97
  • github.com/sparklemotion/sqlite3-ruby/pull/733
  • github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.6
  • github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826

Code Behaviors & Features

Detect and mitigate GHSA-mwm8-39rw-8826 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 1.4.0 before 2.9.6

Fixed versions

  • 2.9.6

Solution

Upgrade to version 2.9.6 or above.

Impact 7.3 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-416: Use After Free

Source file

gem/sqlite3/GHSA-mwm8-39rw-8826.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Mon, 12 Oct 2026 00:23:47 +0000.