Use-After-Free Vulnerability in sqlite3 Ruby Gem: Aggregate Function Handling
Summary
GHSA-mwm8-39rw-8826: sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array. Affects sqlite3 versions >= 1.4.0, < 2.9.6. Fixed in 2.9.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sqlite3 Ruby gem provides a Ruby interface to the SQLite database, allowing developers to interact with SQLite databases using Ruby code. It supports various database operations, including creating, reading, updating, and deleting records. However, a vulnerability has been identified in the way aggregate functions handle multiple arguments, particularly when dealing with TEXT or BLOB column values. This issue can lead to improper memory management and potential application crashes.
Vulnerability Detail
The vulnerability arises when developers use the Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator methods to define aggregate functions that accept two or more arguments. During the evaluation of these functions over TEXT or BLOB column values, Ruby's garbage collection can inadvertently free the objects holding those arguments while still processing a later argument. This results in the aggregate's step method receiving an incorrect object, which can lead to incorrect behavior or a segmentation fault, causing the application to crash.
How To Fix
Latest published version: 2.10.1 as of 23 Oct 2026
gem install sqlite3 -v 2.10.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.6
This is the first release that contains the fix.
gem install sqlite3 -v 2.9.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, avoid defining aggregate functions that take two or more arguments. This can help mitigate the risk, although it does not eliminate it entirely. Additionally, restricting the size of column values may reduce the frequency of the issue but will not prevent it.
Conclusion
In summary, the sqlite3 Ruby gem has a use-after-free vulnerability that affects aggregate functions with multiple arguments. Upgrading to version 2.9.6 or later is the recommended solution to mitigate this risk. If upgrading is not possible, avoid using multi-argument aggregate functions as a temporary workaround.
See every vulnerability recorded for sqlite3 →
FAQ
The sqlite3-ruby maintainers have assessed this vulnerability as Medium severity, with a CVSS score of 6.3.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If left unaddressed, this vulnerability can lead to application crashes or incorrect behavior when using aggregate functions with multiple arguments.
Yes, you can avoid defining aggregate functions that take two or more arguments as a temporary measure.
Detailed information can be found in the vulnerability advisory on GitHub or by visiting Vulert's website.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlite3.
