Browse CVEs

HIGH 7.5 CVE-2026-51304 sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprLi… SQLite No fix yet Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-51302 SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temp… SQLite No fix yet Fix from $1,9502026-07-27 MEDIUM 6.2 CVE-2026-51298 sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program… SQLite No fix yet Fix from $1,6002026-07-27 HIGH 8.8 CVE-2026-51297 sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free … SQLite Mitigation only Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-51296 SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575… SQLite No fix yet Fix from $1,9502026-07-27 HIGH 7.8 CVE-2026-11822 SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes,… SQLite 3.53.2+ Fix from $1,9502026-06-09 HIGH 7.8 CVE-2026-11824 SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a cras… SQLite 3.53.2+ Fix from $1,9502026-06-09 HIGH 7.5 CVE-2025-70873 An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap… SQLite 3.51.1+ Fix from $1,9502026-03-12 CRITICAL 9.1 CVE-2025-7458 An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execut… SQLite 3.41.2+ Fix from $2,3002025-07-29 HIGH 7.7 CVE-2025-6965EPSS 75% There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This … SQLite 3.50.2 / 5.8+ Fix from $1,9502025-07-15 CRITICAL 9.8 CVE-2025-3277 An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQL… SQLite 3.49.1+ Fix from $2,3002025-04-14 MEDIUM 5.5 CVE-2025-29088 In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash… SQLite Patch available Fix from $1,6002025-04-10 HIGH 7.5 CVE-2025-29087 In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffe… SQLite 3.49.1+ Fix from $1,9502025-04-07 MEDIUM 5.5 CVE-2024-0232 A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to … SQLite 3.43.2+ Fix from $1,6002024-01-16 HIGH 7.3 CVE-2023-7104 A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ex… SQLite after 3.43.0 Fix from $1,9502023-12-29 HIGH 7.5 CVE-2021-31239 An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function. SQLite Patch available Fix from $1,9502023-05-09 HIGH 7.3 CVE-2022-46908 SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protect… SQLite 3.40.1+ Fix from $1,9502022-12-12 CRITICAL 9.8 CVE-2020-35527 In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause. SQLite Patch available Fix from $2,3002022-09-01 HIGH 7.5 CVE-2020-35525 In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing. SQLite Patch available Fix from $1,9502022-09-01 HIGH 7.5 CVE-2022-35737EPSS 21% SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. SQLite 3.39.2 / 8.2.12+ Fix from $1,9502022-08-03 HIGH 7.5 CVE-2021-36690 A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQ… SQLite 9.0 / 13.0+ Fix from $1,9502021-08-24 MEDIUM 5.5 CVE-2021-20227 A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on… SQLite 3.34.1 / 9.2.6.0+ Fix from $1,6002021-03-23 MEDIUM 5.5 CVE-2020-15358 In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transit… SQLite 3.32.3 / 7.21+ Fix from $1,6002020-06-27 HIGH 7.5 CVE-2020-13871 SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. SQLite after 8.0.22 Fix from $1,9502020-06-06 MEDIUM 5.5 CVE-2020-13632 ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. SQLite 3.32.0+ Fix from $1,6002020-05-27 HIGH 7.0 CVE-2020-13630 ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. SQLite 3.32.0+ Fix from $1,9502020-05-27 MEDIUM 5.5 CVE-2020-13631 SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. SQLite 1.0.1.1 / 3.32.0+ Fix from $1,6002020-05-27 MEDIUM 5.5 CVE-2020-13434 SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. SQLite 11.4+ Fix from $1,6002020-05-24 MEDIUM 5.5 CVE-2020-13435 SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. SQLite after 3.32.0 Fix from $1,6002020-05-24 CRITICAL 9.8 CVE-2020-11656EPSS 8% In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELEC… SQLite after 12.0.3 Fix from $2,3002020-04-09