Bug 2512144 - CVE-2026-54619 rubygem-sqlite3: sqlite3-ruby: Use-after-free when redefining SQLite functions with different arity [epel-all]
Summary: CVE-2026-54619 rubygem-sqlite3: sqlite3-ruby: Use-after-free when redefining ...
Keywords:
Status: NEW
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: rubygem-sqlite3
Version: epel10
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
Assignee: Troy Dawson
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["1e493eed-254f-4fee-b7c3-b...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-06 18:53 UTC by Joel Chamberlain
Modified: 2026-08-06 18:53 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Joel Chamberlain 2026-08-06 18:53:34 UTC
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite function with a different arity frees the previously registered function handler while SQLite may still reference it, resulting in a use-after-free. This issue is fixed in version 2.9.5.


Note You need to log in before you can comment on or make changes to this bug.