What is CVE-2026-54620?
CVE-2026-54620 is a use-after-free vulnerability in the sqlite3 Ruby library affecting versions 2.1.0 through 2.9.4. The issue occurs when callbacks for SQLite aggregate functions are freed while still in use during aggregation, potentially leading to exploitation. Upgrading to version 2.9.5 resolves the problem.
Azərbaycanca: Ruby üçün sqlite3 kitabxanasında aşkarlanan CVE-2026-54620 zəifliyi, 2.1.0-dan 2.9.4 versiyalarına qədər təsir edir. SQLite aqreqat funksiyalarında istifadə olunan callback-lərin erkən sərbəst buraxılması nəticəsində use-after-free problemi yaranır. Bütün istifadəçilərə dərhal 2.9.5 versiyasına yeniləmə tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-416
FAQ2
What issue does CVE-2026-54620 cause in the sqlite3 library for Ruby?
CVE-2026-54620 causes a use-after-free issue when callbacks for SQLite aggregate functions are freed while still in use during aggregation.
Which version is recommended to upgrade to in order to fix CVE-2026-54620?
Upgrading to version 2.9.5 of the sqlite3 library is recommended to fix CVE-2026-54620.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.