https://vulnerability.circl.lu/sightings/feed 2026-08-14T23:33:52.505490+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/880099ce-4f97-4f3e-be48-55a1f9be6db0/export 2026-08-14T23:33:52.531980+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "880099ce-4f97-4f3e-be48-55a1f9be6db0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51289", "type": "seen", "source": "https://gist.github.com/programmervuln/45be893003233e0a5392b369de70c03f", "content": "vulnerable code link: https://github.com/sqlite/sqlite/blob/version-3.46.0/src/json.c\nCVE-2026-51289 \u2013 MITRE / GHSA Ready Vulnerability Entry\nSibling vulnerability within SQLite JSON extension (json.c), distinct code path separate from CVE-2026-51287 (UAF) and CVE-2026-51288 (OOB read).\nAffected Product\nSQLite\nAffected / Fixed Versions\nAffected: SQLite 3.45.0 up to and including 3.47.1\nFixed: SQLite 3.48.0 and all subsequent releases\nCVE ID\nCVE-2026-51289\nProse Vulnerability Description (Long Form for GHSA & Vendor Advisory)\nAn integer overflow vulnerability leading to heap memory corruption exists within the JSON object key allocation routine in the \nJSON extension (json.c) of SQLite. When parsing specially crafted JSON input containing an extremely large number of object key-value pairs, \narithmetic operations calculating required allocation size for storing object members can overflow a signed integer type. This results in\nundersized heap buffer allocation. Subsequent population of object entries writes data beyond the bounds of the allocated buffer.\nAn attacker able to submit arbitrary SQL queries with controlled JSON payloads to a vulnerable SQLite instance can trigger this flaw. \nSuccessful exploitation may cause application crash (denial of service) and, under favourable heap conditions, lead to arbitrary memory write.\nOnly builds compiled with JSON extension support are vulnerable; binaries built with -DSQLITE_OMIT_JSON are unaffected. This issue is \nindependent of the JSON path evaluation flaws tracked as CVE-2026-51287 and CVE-2026-51288.\nShort Form (MITRE submission character limit optimized)\nAn integer overflow resulting in heap buffer overflow exists in JSON object member allocation logic within the JSON extension (json.c) of SQLite.\nMalicious JSON payloads with a large quantity of object keys trigger miscalculation of buffer size during allocation. Subsequent memory writes\ncorrupt adjacent heap memory. An attacker supplying arbitrary SQL can trigger process crash or potential arbitrary memory modification. \nAffected SQLite versions: 3.45.0\u20133.47.1; fixed in version 3.48.0. Only JSON-enabled builds are vulnerable.\nSupplementary Technical Information\nVulnerability Type: CWE-190 \u2013 Integer Overflow or Wraparound leading to CWE-787 \u2013 Out-of-bounds Write\nRoot Cause\nWhen constructing a JSON object JsonNode, the code computes total memory required to hold all object key-value entries using signed integer \narithmetic. If the parsed object contains enough members, the summation overflows the signed integer variable used for size calculation. \nThe truncated smaller value is passed to the memory allocator, creating an undersized buffer. The program then proceeds to copy all parsed \nobject entries into this insufficient buffer without secondary size validation, causing sequential out-of-bounds heap writes. The vulnerable \nparsing logic operates during initial JSON document deserialization, before any JSON path evaluation.\nImpact & PoC Rationale\nImpact\nDenial of Service: Heap corruption triggers segmentation fault and process termination.\nArbitrary Memory Write: Controlled overflow may enable modification of adjacent heap metadata or application data.\nAttack prerequisite: Attacker controls raw JSON input passed to SQL JSON functions like JSON_EXTRACT(), JSON_VALID(), JSON_OBJECT().\nPoC Rationale\nThe proof-of-concept payload generates a JSON object containing a huge number of inline key-value pairs. When parsed by SQLite\u2019s JSON \ndeserializer, the member count triggers the integer overflow in buffer size calculation. ASAN execution confirms heap buffer overflow writes \nupon parsing the payload.\nsql\n-- Simplified PoC skeleton (expand key count to reach overflow threshold)\nSELECT JSON_VALID('{\"k1\":1,\"k2\":2,\"k3\":3,......,\"kN\":99}');\nPayload must contain sufficient object members to cross the integer overflow threshold; minimal skeleton demonstrates the entry point, \npayload repetition required to hit vulnerable arithmetic.\nAdditional Disclosure Metadata\nWorkaround\nRestrict maximum size and maximum number of object entries for all untrusted JSON inputs before passing to SQLite functions.\nDisable JSON extension via -DSQLITE_OMIT_JSON if unused.\nAvoid directly ingesting unvalidated large JSON from external sources.\nProposed CVSS 3.1 Vector\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\nBase Score: 8.9 (High)\nPatch Context\nThe SQLite 3.48.0 fix adds pre-allocation overflow checks for all size arithmetic during JsonNode creation. If size calculations\nexceed safe bounds, parsing terminates early with an error before memory allocation occurs.", "creation_timestamp": "2026-07-30T03:05:43.277494Z"} 2026-07-30T03:05:43.277494+00:00