AIKIDO-2026-152796
sqlite3 is vulnerable to Use-After-Free
63
Medium Risk
This Affects:
sqlite3TL;DR
The Ruby bindings build a heap-allocated array holding the arguments passed to a custom aggregate function's step callback. When an aggregate defined with two or more arguments is evaluated over TEXT or BLOB column values, the Ruby objects backing earlier arguments can be freed during ordinary garbage collection while a later argument is still being converted. The step method then receives an incorrect object or the process crashes with a segmentation fault. The fix roots the aggregate argument array so the garbage collector keeps the live values reachable during conversion.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you define a custom aggregate function that takes two or more arguments and evaluate it over TEXT or BLOB values whose size can be externally influenced.
Background info
sqlite3 is vulnerable to Use-After-Free in versions 1.4.0 - 2.9.5.
How to fix this
Upgrade the sqlite3 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant