The vulnerability occurs when using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function that takes two or more arguments. When evaluated over TEXT or BLOB column values, the Ruby objects holding these arguments may be freed during ordinary garbage collection while a later argument is still being converted. This results in the aggregate's step method receiving an incorrect object or the process crashing with a segmentation fault. The defect is triggered without unusual code structuring and can be exploited if an attacker can influence the size of the TEXT or BLOB values. No controlled memory write or denial-of-service exploit has been demonstrated. The issue is resolved by upgrading to sqlite3 gem version 2.9.6 or later.

An application using vulnerable versions of Mailcatcher that defines multi-argument aggregate functions over TEXT or BLOB columns may experience incorrect values passed to the aggregate's step method or process crashes due to segmentation faults. This can lead to application instability but has not been shown to allow controlled memory corruption or denial-of-service attacks.

Upgrade to sqlite3 gem version 2.9.6 or later to resolve the vulnerability. There is no reliable workaround if upgrading is not possible; avoid defining aggregate functions that take two or more arguments. Restricting column value sizes is not effective as it only reduces the frequency of the defect but does not prevent it.