Use After Free Affecting sqlite3 package, versions >=2.1.0, <2.9.5

Affected versions of this package are vulnerable to Use After Free via the aggregate function callbacks in Database#create_aggregate, #create_aggregate_handler, and Database#define_aggregator. An attacker can trigger an invalid memory read and segmentation fault by keeping a prepared statement that calls an aggregate function alive after the database has been explicitly closed or discarded, then stepping that statement. The vulnerable code clears the database’s -aggregators reference on close and discard, leaving aggregate callback objects eligible for garbage collection while an open statement still references them. This breaks applications that close a database while outstanding statements remain and can crash the process when the statement later executes.

Notes

• The crash depends on the database being closed with a prepared statement still alive; code that finalizes or drops outstanding statements before closing does not hit this path.
• The advisory covers the aggregate-callback APIs exposed by the gem’s Ruby wrapper, not ordinary scalar query execution.

Workarounds

• Avoid calling an aggregate function from a prepared statement after the associated database has been explicitly closed, including soft-close paths such as close or discard; this prevents the invalid memory read and segmentation fault triggered when the statement is stepped later.

• GitHub Commit
• GitHub PR
• GitHub Release
• Maintainer's Advisory