GHSA-j7fr-3v8c-3qc3

Suggest an improvement
Source
https://github.com/advisories/GHSA-j7fr-3v8c-3qc3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-j7fr-3v8c-3qc3/GHSA-j7fr-3v8c-3qc3.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-j7fr-3v8c-3qc3
Aliases
Published
2026-07-28T16:23:57Z
Modified
2026-07-28T16:30:36.377555169Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
Details

Summary

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid using an aggregate function after closing the database.

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-416"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T16:23:57Z",
    "severity": "LOW"
}
References

Affected packages

RubyGems / sqlite3-ruby

Package

Name
sqlite3-ruby
Purl
pkg:gem/sqlite3-ruby

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.9.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-j7fr-3v8c-3qc3/GHSA-j7fr-3v8c-3qc3.json"
last_known_affected_version_range 
"<= 2.9.4"

RubyGems / sqlite3

Package

Name
sqlite3
Purl
pkg:gem/sqlite3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.9.5

Affected versions

2.*
2.1.0
2.1.1
2.2.0
2.3.0
2.3.1
2.4.0
2.4.1
2.5.0.rc1
2.5.0
2.6.0
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.8.0
2.8.1
2.9.0
2.9.1
2.9.2.rc2
2.9.2
2.9.3
2.9.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-j7fr-3v8c-3qc3/GHSA-j7fr-3v8c-3qc3.json"
last_known_affected_version_range 
"<= 2.9.4"