Repository navigation
Update dependency sqlite3 to v2.9.6 [SECURITY] - #72
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/rubygems-sqlite3-vulnerability
branch
from
August 15, 2026 07:56
a501e44 to
282609a
Compare
Coverage Report for CI Build 31873226753Coverage remained the same at 57.143%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
renovate
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.8.1-arm64-darwin→2.9.6sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
CVE-2026-54620 / GHSA-j7fr-3v8c-3qc3
More information
Details
Summary
Using
Database#create_aggregate,#create_aggregate_handler, orDatabase#define_aggregatorto define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.Mitigation
Upgrade to sqlite3 gem v2.9.5 or later.
As a workaround, avoid using an aggregate function after closing the database.
Severity
The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.
Severity
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
CVE-2026-54619 / GHSA-28hh-pr2h-2w89
More information
Details
Summary
Using
Database#create_functionorDatabase#define_functionto define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.Mitigation
Upgrade to sqlite3 gem v2.9.5 or later.
As a workaround, avoid defining multiple custom functions with the same name (varying numbers of arguments or encoding).
Severity
The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.
Severity
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array
GHSA-mwm8-39rw-8826
More information
Details
Summary
Using
Database#create_aggregate,#create_aggregate_handler, orDatabase#define_aggregatorto define an aggregate function that takes two or more arguments, and then evaluating it over TEXT or BLOB column values, can free the Ruby objects holding those arguments while a later argument is still being converted, during ordinary garbage collection. The aggregate'sstepmethod then receives an incorrect object, or the process crashes with a segmentation fault.Mitigation
Upgrade to sqlite3 gem v2.9.6 or later.
There is no reliable workaround. If you cannot upgrade, avoid defining aggregate functions that take two or more arguments. Restricting column value sizes is not a mitigation: smaller values make the defect fire less often but do not prevent it.
Severity
The sqlite3-ruby maintainers assess this as Medium severity (CVSS 4.0 score 6.3). It is reached through ordinary garbage collection without any unusual code structuring: an application is exposed whenever it evaluates a multi-argument aggregate over TEXT or BLOB values whose size an attacker can influence. The demonstrated impact is an incorrect value passed to the aggregate's
stepmethod, or a process crash; no controlled memory write or general denial-of-service exploit has been demonstrated.Credits
Reported by Jeremy Daer (@jeremy).
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sparklemotion/sqlite3-ruby (sqlite3)
v2.9.6Compare Source
Security / Stability
stepwas not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed tostepor crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @jeremyFixed
GROUP BYgroup per query for its lifetime. #722 @djmb#traceand#authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raiseNoMethodError, return a wrong result, or segfault. Affects applications that callGC.compactor run withGC.auto_compact = true. The equivalent issue in#busy_handlerwas fixed in #466. #723 @djmbDatabase#open_v2and#open16silently replacing a live connection and leaking the previous connection handle when invoked viasendon an open database. They now raiseSQLite3::Exception. #729 @flavorjonesDatabase#define_function. #730 @flavorjonesDatabase#define_functionblock leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @flavorjonesDatabase.newnow raisesArgumentErrorwhen the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @flavorjonesImproved
Database.newfails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @katafraktv2.9.5Compare Source
Dependencies
Security / Stability
v2.9.4Compare Source
v2.9.3Compare Source
v2.9.2Compare Source
v2.9.1Compare Source
v2.9.0Compare Source
Ruby
Added
Statement#named_paramsto introspect on a parameterized SQL statement. #627 #642 @captn3m0Improved
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.