Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
197 vulnerabilities found for SQLite by SQLite
CVE-2026-119591 (GCVE-0-2026-119591)
Vulnerability from nvd – Published: 2026-10-30 11:31 – Updated: 2026-10-30 11:31
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
Severity
5.5 (Medium)
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-10-04T05:34:47Z | issue-tracking |
| https://sqlite.org/src/info/ab621a3e11ee4acc | patch |
| https://github.com/sqlite/sqlite/commit/eff50a067… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-values-union | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/sqlite/sqlite",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ke Han"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:15.714Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T05:34:47Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/ab621a3e11ee4acc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-values-union"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"
}
],
"title": "SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119591",
"datePublished": "2026-10-30T11:31:15.714Z",
"dateReserved": "2026-10-30T11:20:35.123Z",
"dateUpdated": "2026-10-30T11:31:15.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119586 (GCVE-0-2026-119586)
Vulnerability from nvd – Published: 2026-10-30 11:31 – Updated: 2026-10-30 16:19
VLAI
EPSS
VEX
Title
SQLite CLI through 3.54.1 Command Injection via .recover Output
Summary
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:18 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://abraxaslabs.tech/research/sqlite-cli-recover | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-cli-t… | third-party-advisory |
Impacted products
Date Public
2026-10-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:18:54.707240Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:19:09.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/sqlite/sqlite",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThanOrEqual": "3.54.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.54.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:15.070Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-cli-recover"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite CLI through 3.54.1 Command Injection via .recover Output",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"
}
],
"title": "SQLite CLI through 3.54.1 Command Injection via .recover Output",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119586",
"datePublished": "2026-10-30T11:31:15.070Z",
"dateReserved": "2026-10-30T11:14:48.751Z",
"dateUpdated": "2026-10-30T16:19:09.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119379 (GCVE-0-2026-119379)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 16:02
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
Summary
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:54 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-08-16T10:15:25Z | issue-tracking |
| https://sqlite.org/src/info/3f57024aecea0f3b | patch |
| https://github.com/sqlite/sqlite/commit/64459c87c… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-session-ncol | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:54:31.625606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:02:09.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_SESSION is defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marc Heuse"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:43.335Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/3f57024aecea0f3b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-session-ncol"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"
}
],
"title": "SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119379",
"datePublished": "2026-10-30T11:30:43.335Z",
"dateReserved": "2026-10-30T00:57:06.710Z",
"dateUpdated": "2026-10-30T16:02:09.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119378 (GCVE-0-2026-119378)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:56
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
Summary
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://sqlite.org/src/info/6a9e1415659f9e75 | patch |
| https://github.com/sqlite/sqlite/commit/d21bd37c7… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-rtree-rowid0 | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:53.674733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:56:16.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_RTREE (or SQLITE_ENABLE_GEOPOLY) is defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claude and Ada Logics"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-09-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:42.626Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/6a9e1415659f9e75"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-rtree-rowid0"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"
}
],
"title": "SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119378",
"datePublished": "2026-10-30T11:30:42.626Z",
"dateReserved": "2026-10-30T00:57:06.311Z",
"dateUpdated": "2026-10-30T15:56:16.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119377 (GCVE-0-2026-119377)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
Summary
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-07-05T08:15:45Z | issue-tracking |
| https://sqlite.org/src/info/bbd69ce274620008 | patch |
| https://github.com/sqlite/sqlite/commit/7ff247c5b… | patch |
| https://sqlite.org/src/info/2cb22877683680c1 | patch |
| https://github.com/sqlite/sqlite/commit/5694c3bb2… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-fj-using-auth | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-07-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ylwang"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-07-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table\u0027s USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:41.921Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-07-05T08:15:45Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/bbd69ce274620008"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/2cb22877683680c1"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-fj-using-auth"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"
}
],
"title": "SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119377",
"datePublished": "2026-10-30T11:30:41.921Z",
"dateReserved": "2026-10-30T00:57:05.903Z",
"dateUpdated": "2026-10-30T11:30:41.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119376 (GCVE-0-2026-119376)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Severity
5.5 (Medium)
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-10-04T04:50:56Z | issue-tracking |
| https://sqlite.org/src/info/252c0b7bf5a727d2 | patch |
| https://github.com/sqlite/sqlite/commit/d54522a5b… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-collate-depth | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ke Han"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:41.213Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/252c0b7bf5a727d2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-collate-depth"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"
}
],
"title": "SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119376",
"datePublished": "2026-10-30T11:30:41.213Z",
"dateReserved": "2026-10-30T00:57:05.506Z",
"dateUpdated": "2026-10-30T11:30:41.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119375 (GCVE-0-2026-119375)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:52
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
Summary
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:52 UTC
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-08-17T15:54:41Z | issue-tracking |
| https://sqlite.org/src/info/f9b4ee369557c36c | patch |
| https://github.com/sqlite/sqlite/commit/e5bf11982… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-wal-pagesize | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:52:42.874683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:52:57.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Winter"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:40.533Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-08-17T15:54:41Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/f9b4ee369557c36c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-wal-pagesize"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"
}
],
"title": "SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119375",
"datePublished": "2026-10-30T11:30:40.533Z",
"dateReserved": "2026-10-30T00:39:33.546Z",
"dateUpdated": "2026-10-30T15:52:57.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119374 (GCVE-0-2026-119374)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:56
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()
Summary
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:34 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://sqlite.org/src/info/9cd4f9e920 | patch |
| https://github.com/sqlite/sqlite/commit/d9de6eedb… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-fts5-securedel | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:34:49.257415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:56:39.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_FTS5 is defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "YEONBA"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:39.834Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/9cd4f9e920"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-fts5-securedel"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"
}
],
"title": "SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119374",
"datePublished": "2026-10-30T11:30:39.834Z",
"dateReserved": "2026-10-30T00:39:33.151Z",
"dateUpdated": "2026-10-30T15:56:39.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119373 (GCVE-0-2026-119373)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
Summary
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-08-04T08:49:27Z | issue-tracking |
| https://sqlite.org/src/info/a7f8c92f62 | patch |
| https://github.com/sqlite/sqlite/commit/e1c9934f9… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-fts5-row… | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_FTS5 is defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michele"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:39.153Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/a7f8c92f62"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"
}
],
"title": "SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119373",
"datePublished": "2026-10-30T11:30:39.153Z",
"dateReserved": "2026-10-30T00:39:32.759Z",
"dateUpdated": "2026-10-30T11:30:39.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119372 (GCVE-0-2026-119372)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
Summary
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
Severity
5.5 (Medium)
CWE
- CWE-416 - Use After Free
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-08-17T09:18:24Z | issue-tracking |
| https://sqlite.org/src/info/e4635c4153 | patch |
| https://github.com/sqlite/sqlite/commit/a87bd2471… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-fts3-snippet | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_FTS3 (or SQLITE_ENABLE_FTS4) and SQLITE_ENABLE_FTS3_PARENTHESIS are defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marc Heuse"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:38.453Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-08-17T09:18:24Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/e4635c4153"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-fts3-snippet"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"
}
],
"title": "SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119372",
"datePublished": "2026-10-30T11:30:38.453Z",
"dateReserved": "2026-10-30T00:39:32.365Z",
"dateUpdated": "2026-10-30T11:30:38.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119371 (GCVE-0-2026-119371)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:51
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:50 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-10-04T04:58:58Z | issue-tracking |
| https://sqlite.org/src/info/f54730871303e655 | patch |
| https://github.com/sqlite/sqlite/commit/e6ff280c8… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-cte-nest | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:50:50.830999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:51:05.359Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ke Han"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:37.740Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T04:58:58Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/f54730871303e655"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-cte-nest"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"
}
],
"title": "SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119371",
"datePublished": "2026-10-30T11:30:37.740Z",
"dateReserved": "2026-10-30T00:39:31.960Z",
"dateUpdated": "2026-10-30T15:51:05.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-51304 (GCVE-0-2026-51304)
Vulnerability from nvd – Published: 2026-07-27 00:00 – Updated: 2026-07-31 14:34
VLAI
EPSS
VEX
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-07-31T14:34:39.044Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-51304",
"datePublished": "2026-07-27T00:00:00.000Z",
"dateRejected": "2026-07-31T00:00:00.000Z",
"dateReserved": "2026-06-07T00:00:00.000Z",
"dateUpdated": "2026-07-31T14:34:39.044Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-51302 (GCVE-0-2026-51302)
Vulnerability from nvd – Published: 2026-07-27 00:00 – Updated: 2026-07-31 14:34
VLAI
EPSS
VEX
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-07-31T14:34:37.145Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-51302",
"datePublished": "2026-07-27T00:00:00.000Z",
"dateRejected": "2026-07-31T00:00:00.000Z",
"dateReserved": "2026-06-07T00:00:00.000Z",
"dateUpdated": "2026-07-31T14:34:37.145Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-51298 (GCVE-0-2026-51298)
Vulnerability from nvd – Published: 2026-07-27 00:00 – Updated: 2026-07-31 14:34
VLAI
EPSS
VEX
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-07-31T14:34:34.844Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-51298",
"datePublished": "2026-07-27T00:00:00.000Z",
"dateRejected": "2026-07-31T00:00:00.000Z",
"dateReserved": "2026-06-07T00:00:00.000Z",
"dateUpdated": "2026-07-31T14:34:34.844Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-51297 (GCVE-0-2026-51297)
Vulnerability from nvd – Published: 2026-07-27 00:00 – Updated: 2026-07-31 14:34
VLAI
EPSS
VEX
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-07-31T14:34:34.058Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-51297",
"datePublished": "2026-07-27T00:00:00.000Z",
"dateRejected": "2026-07-31T00:00:00.000Z",
"dateReserved": "2026-06-07T00:00:00.000Z",
"dateUpdated": "2026-07-31T14:34:34.058Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-51296 (GCVE-0-2026-51296)
Vulnerability from nvd – Published: 2026-07-27 00:00 – Updated: 2026-07-31 14:34
VLAI
EPSS
VEX
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-07-31T14:34:33.252Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-51296",
"datePublished": "2026-07-27T00:00:00.000Z",
"dateRejected": "2026-07-31T00:00:00.000Z",
"dateReserved": "2026-06-07T00:00:00.000Z",
"dateUpdated": "2026-07-31T14:34:33.252Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119591 (GCVE-0-2026-119591)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 11:31
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
Severity
5.5 (Medium)
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-10-04T05:34:47Z | issue-tracking |
| https://sqlite.org/src/info/ab621a3e11ee4acc | patch |
| https://github.com/sqlite/sqlite/commit/eff50a067… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-values-union | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/sqlite/sqlite",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ke Han"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:15.714Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T05:34:47Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/ab621a3e11ee4acc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-values-union"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"
}
],
"title": "SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119591",
"datePublished": "2026-10-30T11:31:15.714Z",
"dateReserved": "2026-10-30T11:20:35.123Z",
"dateUpdated": "2026-10-30T11:31:15.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119586 (GCVE-0-2026-119586)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 16:19
VLAI
EPSS
VEX
Title
SQLite CLI through 3.54.1 Command Injection via .recover Output
Summary
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:18 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://abraxaslabs.tech/research/sqlite-cli-recover | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-cli-t… | third-party-advisory |
Impacted products
Date Public
2026-10-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:18:54.707240Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:19:09.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/sqlite/sqlite",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThanOrEqual": "3.54.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.54.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:15.070Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-cli-recover"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite CLI through 3.54.1 Command Injection via .recover Output",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"
}
],
"title": "SQLite CLI through 3.54.1 Command Injection via .recover Output",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119586",
"datePublished": "2026-10-30T11:31:15.070Z",
"dateReserved": "2026-10-30T11:14:48.751Z",
"dateUpdated": "2026-10-30T16:19:09.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119379 (GCVE-0-2026-119379)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 16:02
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
Summary
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:54 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-08-16T10:15:25Z | issue-tracking |
| https://sqlite.org/src/info/3f57024aecea0f3b | patch |
| https://github.com/sqlite/sqlite/commit/64459c87c… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-session-ncol | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119379",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:54:31.625606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:02:09.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_SESSION is defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marc Heuse"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:43.335Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-08-16T10:15:25Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/3f57024aecea0f3b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-session-ncol"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"
}
],
"title": "SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119379",
"datePublished": "2026-10-30T11:30:43.335Z",
"dateReserved": "2026-10-30T00:57:06.710Z",
"dateUpdated": "2026-10-30T16:02:09.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119378 (GCVE-0-2026-119378)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:56
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
Summary
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://sqlite.org/src/info/6a9e1415659f9e75 | patch |
| https://github.com/sqlite/sqlite/commit/d21bd37c7… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-rtree-rowid0 | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:53.674733Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:56:16.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_RTREE (or SQLITE_ENABLE_GEOPOLY) is defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claude and Ada Logics"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-09-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:42.626Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/6a9e1415659f9e75"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-rtree-rowid0"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"
}
],
"title": "SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119378",
"datePublished": "2026-10-30T11:30:42.626Z",
"dateReserved": "2026-10-30T00:57:06.311Z",
"dateUpdated": "2026-10-30T15:56:16.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119377 (GCVE-0-2026-119377)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
Summary
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-07-05T08:15:45Z | issue-tracking |
| https://sqlite.org/src/info/bbd69ce274620008 | patch |
| https://github.com/sqlite/sqlite/commit/7ff247c5b… | patch |
| https://sqlite.org/src/info/2cb22877683680c1 | patch |
| https://github.com/sqlite/sqlite/commit/5694c3bb2… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-fj-using-auth | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-07-05 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ylwang"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-07-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table\u0027s USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:41.921Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-07-05T08:15:45Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/bbd69ce274620008"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/2cb22877683680c1"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-fj-using-auth"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"
}
],
"title": "SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119377",
"datePublished": "2026-10-30T11:30:41.921Z",
"dateReserved": "2026-10-30T00:57:05.903Z",
"dateUpdated": "2026-10-30T11:30:41.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119376 (GCVE-0-2026-119376)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Severity
5.5 (Medium)
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-10-04T04:50:56Z | issue-tracking |
| https://sqlite.org/src/info/252c0b7bf5a727d2 | patch |
| https://github.com/sqlite/sqlite/commit/d54522a5b… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-collate-depth | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ke Han"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:41.213Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/252c0b7bf5a727d2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-collate-depth"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"
}
],
"title": "SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119376",
"datePublished": "2026-10-30T11:30:41.213Z",
"dateReserved": "2026-10-30T00:57:05.506Z",
"dateUpdated": "2026-10-30T11:30:41.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119375 (GCVE-0-2026-119375)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:52
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
Summary
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:52 UTC
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-08-17T15:54:41Z | issue-tracking |
| https://sqlite.org/src/info/f9b4ee369557c36c | patch |
| https://github.com/sqlite/sqlite/commit/e5bf11982… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-wal-pagesize | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:52:42.874683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:52:57.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Winter"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:40.533Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-08-17T15:54:41Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/f9b4ee369557c36c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-wal-pagesize"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"
}
],
"title": "SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119375",
"datePublished": "2026-10-30T11:30:40.533Z",
"dateReserved": "2026-10-30T00:39:33.546Z",
"dateUpdated": "2026-10-30T15:52:57.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119374 (GCVE-0-2026-119374)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:56
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()
Summary
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:34 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://sqlite.org/src/info/9cd4f9e920 | patch |
| https://github.com/sqlite/sqlite/commit/d9de6eedb… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-fts5-securedel | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:34:49.257415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:56:39.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_FTS5 is defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "YEONBA"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:39.834Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/9cd4f9e920"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-fts5-securedel"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"
}
],
"title": "SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119374",
"datePublished": "2026-10-30T11:30:39.834Z",
"dateReserved": "2026-10-30T00:39:33.151Z",
"dateUpdated": "2026-10-30T15:56:39.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119373 (GCVE-0-2026-119373)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
Summary
SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process.
Severity
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-08-04T08:49:27Z | issue-tracking |
| https://sqlite.org/src/info/a7f8c92f62 | patch |
| https://github.com/sqlite/sqlite/commit/e1c9934f9… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-fts5-row… | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-04 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_FTS5 is defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michele"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:39.153Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-08-04T08:49:27Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/a7f8c92f62"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"
}
],
"title": "SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119373",
"datePublished": "2026-10-30T11:30:39.153Z",
"dateReserved": "2026-10-30T00:39:32.759Z",
"dateUpdated": "2026-10-30T11:30:39.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119372 (GCVE-0-2026-119372)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
Summary
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
Severity
5.5 (Medium)
CWE
- CWE-416 - Use After Free
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-08-17T09:18:24Z | issue-tracking |
| https://sqlite.org/src/info/e4635c4153 | patch |
| https://github.com/sqlite/sqlite/commit/a87bd2471… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-fts3-snippet | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-17 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"platforms": [
"All platforms where SQLITE_ENABLE_FTS3 (or SQLITE_ENABLE_FTS4) and SQLITE_ENABLE_FTS3_PARENTHESIS are defined"
],
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marc Heuse"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Dan Kennedy"
}
],
"datePublic": "2026-08-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:38.453Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-08-17T09:18:24Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/e4635c4153"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-fts3-snippet"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"
}
],
"title": "SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119372",
"datePublished": "2026-10-30T11:30:38.453Z",
"dateReserved": "2026-10-30T00:39:32.365Z",
"dateUpdated": "2026-10-30T11:30:38.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119371 (GCVE-0-2026-119371)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:51
VLAI
EPSS
VEX
Title
SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()
Summary
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:50 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://sqlite.org/bugs/info/2026-10-04T04:58:58Z | issue-tracking |
| https://sqlite.org/src/info/f54730871303e655 | patch |
| https://github.com/sqlite/sqlite/commit/e6ff280c8… | patch |
| https://github.com/sqlite/sqlite/blob/version-3.5… | technical-description |
| https://sqlite.org/releaselog/3_54_0.html | release-notes |
| https://abraxaslabs.tech/research/sqlite-cte-nest | third-party-advisory |
| https://github.com/sqlite/sqlite | product |
| https://www.vulncheck.com/advisories/sqlite-befor… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119371",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:50:50.830999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:51:05.359Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sqlite.org/",
"defaultStatus": "unaffected",
"product": "SQLite",
"repo": "https://github.com/sqlite/sqlite",
"vendor": "SQLite",
"versions": [
{
"lessThan": "3.54.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.54.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ke Han"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "D. Richard Hipp"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:37.740Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://sqlite.org/bugs/info/2026-10-04T04:58:58Z"
},
{
"tags": [
"patch"
],
"url": "https://sqlite.org/src/info/f54730871303e655"
},
{
"tags": [
"patch"
],
"url": "https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754"
},
{
"tags": [
"release-notes"
],
"url": "https://sqlite.org/releaselog/3_54_0.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/sqlite-cte-nest"
},
{
"tags": [
"product"
],
"url": "https://github.com/sqlite/sqlite"
},
{
"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"
}
],
"title": "SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119371",
"datePublished": "2026-10-30T11:30:37.740Z",
"dateReserved": "2026-10-30T00:39:31.960Z",
"dateUpdated": "2026-10-30T15:51:05.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-51304 (GCVE-0-2026-51304)
Vulnerability from cvelistv5 – Published: 2026-07-27 00:00 – Updated: 2026-07-31 14:34
VLAI
EPSS
VEX
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-07-31T14:34:39.044Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-51304",
"datePublished": "2026-07-27T00:00:00.000Z",
"dateRejected": "2026-07-31T00:00:00.000Z",
"dateReserved": "2026-06-07T00:00:00.000Z",
"dateUpdated": "2026-07-31T14:34:39.044Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-51296 (GCVE-0-2026-51296)
Vulnerability from cvelistv5 – Published: 2026-07-27 00:00 – Updated: 2026-07-31 14:34
VLAI
EPSS
VEX
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-07-31T14:34:33.252Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-51296",
"datePublished": "2026-07-27T00:00:00.000Z",
"dateRejected": "2026-07-31T00:00:00.000Z",
"dateReserved": "2026-06-07T00:00:00.000Z",
"dateUpdated": "2026-07-31T14:34:33.252Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-51302 (GCVE-0-2026-51302)
Vulnerability from cvelistv5 – Published: 2026-07-27 00:00 – Updated: 2026-07-31 14:34
VLAI
EPSS
VEX
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-07-31T14:34:37.145Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-51302",
"datePublished": "2026-07-27T00:00:00.000Z",
"dateRejected": "2026-07-31T00:00:00.000Z",
"dateReserved": "2026-06-07T00:00:00.000Z",
"dateUpdated": "2026-07-31T14:34:37.145Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}