LOW GitHub
CVE-2026-54619
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
## Summary
Using `Database#create_function` or `Database#define_function` to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.
## Mitigation
Upgrade to sqlite3 gem v2.9.5 or later.
As a workaround, avoid defining multiple custom functions with the same name (varying numbers of arguments or encoding).
## Severity
The sqlite3-ruby maintainers assess this as Low severity.
Affected Products
- rubygems/sqlite3-ruby <= 2.9.4
- rubygems/sqlite3 <= 2.9.4
References
- https://github.com/advisories/GHSA-28hh-pr2h-2w89
- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-28hh-pr2h-2w89
- https://github.com/sparklemotion/sqlite3-ruby/pull/710
- https://github.com/sparklemotion/sqlite3-ruby/commit/2bd436d17f77cdd4c31b00fe9d50b0d21cbaf
This low severity vulnerability was published on 2026-07-28 via GitHub. Affected: rubygems/sqlite3-ruby <= 2.9.4, rubygems/sqlite3 <= 2.9.4.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.