AIKIDO-2026-11127

TL;DR

The sqlite3 Ruby gem registers user-defined SQLite functions through C extension callbacks that hold pointers to Ruby blocks. Redefining the same function name with a different arity replaces the stored block while SQLite may still reference the prior callback, and garbage collection can then trigger an invalid memory read and segmentation fault. Affected applications using create_function or define_function with duplicate names and varying argument counts can crash the Ruby process. Version 2.9.5 retains all function blocks for the database object lifetime instead of overwriting them in a name-keyed collection.