--- title: GHSA-mwm8-39rw-8826 (sqlite3): Use-After-Free in SQLite... description: A use-after-free vulnerability affects the sqlite3 Ruby gem when using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to... canonical: https://daily.dev/posts/ghsa-mwm8-39rw-8826-sqlite3-use-after-free-in-sqlite-aggregate-arguments-in-heap-allocated-argume-uffc8mqxd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GHSA-mwm8-39rw-8826 (sqlite3): Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array | daily.dev og:description: A use-after-free vulnerability affects the sqlite3 Ruby gem when using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to... og:url: https://daily.dev/posts/ghsa-mwm8-39rw-8826-sqlite3-use-after-free-in-sqlite-aggregate-arguments-in-heap-allocated-argume-uffc8mqxd og:image: https://api.daily.dev/og/posts/UFfC8Mqxd.png og:image:alt: GHSA-mwm8-39rw-8826 (sqlite3): Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GHSA-mwm8-39rw-8826 (sqlite3): Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array **[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 0 upvotes · 0 comments ## Summary A use-after-free vulnerability affects the sqlite3 Ruby gem when using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define aggregate functions taking two or more arguments over TEXT or BLOB column values. During ordinary garbage collection, Ruby objects holding those arguments can be freed while a later argument is still being converted, causing the step method to receive an incorrect object or the process to crash with a segmentation fault. Versions before 1.4.0 are unaffected, and the issue is patched in version 2.9.6 and later. Reported by Jeremy Daer. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the use-after-free vulnerability in the sqlite3 Ruby gem's aggregate functions? Defining an aggregate function with two or more arguments via Database#create_aggregate, #create_aggregate_handler, or #define_aggregator and evaluating it over TEXT or BLOB column values can free Ruby argument objects during ordinary garbage collection while a later argument is still being converted. This causes the step method to receive an incorrect object or crash the process with a segmentation fault. It is tracked as GHSA-mwm8-39rw-8826. _daily.dev surfaces advisories like this for teams patching sqlite3 gem vulnerabilities before deployment._ ### Which versions of the sqlite3 Ruby gem are affected by GHSA-mwm8-39rw-8826? Versions before 1.4.0 are unaffected, meaning the vulnerable code path applies to versions from 1.4.0 onward, and the fix is included in version 2.9.6 and later. Ruby applications using aggregate functions with multiple TEXT or BLOB arguments should upgrade to 2.9.6 or newer to avoid the use-after-free bug. _Track sqlite3 gem patch versions on daily.dev before rolling out dependency upgrades._ ## Similar posts on daily.dev - [When Your Hash Becomes a String: Hunting Ruby’s Million-to-One Memory Bug](https://daily.dev/posts/when-your-hash-becomes-a-string-hunting-ruby-s-million-to-one-memory-bug-nhlgsnql3) · Closer to Code · 0 upvotes · 0 comments - [GHSA-wjv4-x9w8-wm3h \(nokogiri\): Nokogiri: Possible Use-After-Free when setting \`Document\#root=\` to an invalid node type](https://daily.dev/posts/ghsa-wjv4-x9w8-wm3h-nokogiri-nokogiri-possible-use-after-free-when-setting-document-root-to-a-xywfcl9r4) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-wfpw-mmfh-qq69 \(nokogiri\): Nokogiri: Possible Use-After-Free in XInclude Processing](https://daily.dev/posts/ghsa-wfpw-mmfh-qq69-nokogiri-nokogiri-possible-use-after-free-in-xinclude-processing-cojiekie2) · RUBYLAND · 0 upvotes · 0 comments - [CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler](https://daily.dev/posts/cve-2026-46727-use-after-free-in-pthread-based-getaddrinfo-timeout-handler-wsx4kaak6) · Ruby · 1 upvotes · 0 comments - [GHSA-p67v-3w7g-wjg7 \(nokogiri\): Nokogiri: Possible Use-After-Free when directly using \`NokogirI::XML::XPathContext\` beyond document lifetime](https://daily.dev/posts/ghsa-p67v-3w7g-wjg7-nokogiri-nokogiri-possible-use-after-free-when-directly-using-nokogiri-xml-bezfin1jt) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby), [#sqlite](https://daily.dev/tags/sqlite) [View this post on daily.dev](https://daily.dev/posts/ghsa-mwm8-39rw-8826-sqlite3-use-after-free-in-sqlite-aggregate-arguments-in-heap-allocated-argume-uffc8mqxd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GHSA-mwm8-39rw-8826 (sqlite3): Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array","url":"https://daily.dev/posts/ghsa-mwm8-39rw-8826-sqlite3-use-after-free-in-sqlite-aggregate-arguments-in-heap-allocated-argume-uffc8mqxd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghsa-mwm8-39rw-8826-sqlite3-use-after-free-in-sqlite-aggregate-arguments-in-heap-allocated-argume-uffc8mqxd"},"datePublished":"2026-08-13T14:24:25.214Z","dateModified":"2026-08-13T14:24:45.620Z","description":"A use-after-free vulnerability affects the sqlite3 Ruby gem when using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghsa-mwm8-39rw-8826-sqlite3-use-after-free-in-sqlite-aggregate-arguments-in-heap-allocated-argume-uffc8mqxd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby,sqlite","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"GHSA-mwm8-39rw-8826 (sqlite3): Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghsa-mwm8-39rw-8826-sqlite3-use-after-free-in-sqlite-aggregate-arguments-in-heap-allocated-argume-uffc8mqxd#faq","mainEntity":[{"@type":"Question","name":"What is the use-after-free vulnerability in the sqlite3 Ruby gem's aggregate functions?","acceptedAnswer":{"@type":"Answer","text":"Defining an aggregate function with two or more arguments via Database#create_aggregate, #create_aggregate_handler, or #define_aggregator and evaluating it over TEXT or BLOB column values can free Ruby argument objects during ordinary garbage collection while a later argument is still being converted. This causes the step method to receive an incorrect object or crash the process with a segmentation fault. It is tracked as GHSA-mwm8-39rw-8826. daily.dev surfaces advisories like this for teams patching sqlite3 gem vulnerabilities before deployment."}},{"@type":"Question","name":"Which versions of the sqlite3 Ruby gem are affected by GHSA-mwm8-39rw-8826?","acceptedAnswer":{"@type":"Answer","text":"Versions before 1.4.0 are unaffected, meaning the vulnerable code path applies to versions from 1.4.0 onward, and the fix is included in version 2.9.6 and later. Ruby applications using aggregate functions with multiple TEXT or BLOB arguments should upgrade to 2.9.6 or newer to avoid the use-after-free bug. Track sqlite3 gem patch versions on daily.dev before rolling out dependency upgrades."}}]} ```