Skip to content
OpenAdvisories

Description

There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.

Affected products

VendorProductAffectedFixed
SQLite SQLite < 3.50.2 3.50.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 sqlite3 3.46.1-7 —
Debian 13 sqlite3 3.46.1-7 —
Debian 12 sqlite3 3.40.1-2+deb12u2 —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 sqlite3 3.46.1-6ubuntu1 —
Ubuntu 24.04 LTS sqlite3 3.45.1-1ubuntu2.4 USN-7676-1
Ubuntu 22.04 LTS sqlite3 3.37.2-2ubuntu0.5 USN-7676-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS sqlite3 3.31.1-4ubuntu0.7+esm1 USN-7679-1
Ubuntu Pro 18.04 LTS sqlite3 3.22.0-1ubuntu0.7+esm2 USN-7679-1
Ubuntu Pro 16.04 LTS sqlite3 3.11.0-1ubuntu1.5+esm3 USN-7679-1
Ubuntu Pro 14.04 LTS sqlite3 3.8.2-1ubuntu2.2+esm5 USN-7679-1
ReleasePackageFixed inAdvisory
RHEL 10 sqlite +2 3.46.1-5.el10_0 RHSA-2025:11933
RHEL 9 nodejs +4 1:22.16.0-2.module+el9.6.0+23339+d3c8acfa RHSA-2025:11802
RHEL 9 nodejs-nodemon 3.0.1-1.module+el9.6.0+23339+d3c8acfa RHSA-2025:11802
RHEL 9 nodejs-packaging +1 2021.06-4.module+el9.6.0+23339+d3c8acfa RHSA-2025:11802
RHEL 9 npm 1:10.9.2-1.22.16.0.2.module+el9.6.0+23339+d3c8acfa RHSA-2025:11802
RHEL 9 sqlite +2 3.34.1-8.el9_6 RHSA-2025:20936, RHSA-2025:11992
RHEL 9 v8-12.4-devel 3:12.4.254.21-1.22.16.0.2.module+el9.6.0+23339+d3c8acfa RHSA-2025:11802
RHEL 8 lemon +4 3.26.0-20.el8_10 RHSA-2025:12010
RHEL 8 mingw-sqlite +4 3.26.0.0-2.el8_10 RHSA-2025:14101
RHEL 8 nodejs +4 1:22.16.0-2.module+el8.10.0+23338+c5a38893 RHSA-2025:11803
RHEL 8 nodejs-nodemon 3.0.1-1.module+el8.10.0+23140+4056b950 RHSA-2025:11803
RHEL 8 nodejs-packaging +1 2021.06-4.module+el8.10.0+23140+4056b950 RHSA-2025:11803
RHEL 8 npm 1:10.9.2-1.22.16.0.2.module+el8.10.0+23338+c5a38893 RHSA-2025:11803
RHEL 8 v8-12.4-devel 3:12.4.254.21-1.22.16.0.2.module+el8.10.0+23338+c5a38893 RHSA-2025:11803
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 EUS sqlite +2 3.34.1-7.el9_4.1 RHSA-2025:12036
RHEL 9.2 E4S sqlite +2 3.34.1-6.el9_2.2 RHSA-2025:12749
RHEL 9.0 E4S sqlite +2 3.34.1-5.el9_0.1 RHSA-2025:12522
RHEL 8.8 TUS lemon +4 3.26.0-18.el8_8.2 RHSA-2025:12521
RHEL 8.8 TUS spice-client-win +2 8.10-3.el8_8.1 RHSA-2026:0001
RHEL 8.8 E4S lemon +4 3.26.0-18.el8_8.2 RHSA-2025:12521
RHEL 8.8 E4S spice-client-win +2 8.10-3.el8_8.1 RHSA-2026:0001
RHEL 8.6 TUS lemon +4 3.26.0-16.el8_6.3 RHSA-2025:12904
RHEL 8.6 TUS spice-client-win +2 8.10-3.el8_6.1 RHSA-2026:0076
RHEL 8.6 E4S lemon +4 3.26.0-16.el8_6.3 RHSA-2025:12904
RHEL 8.6 E4S spice-client-win +2 8.10-3.el8_6.1 RHSA-2026:0076
RHEL 8.6 AUS lemon +4 3.26.0-16.el8_6.3 RHSA-2025:12904
RHEL 8.6 AUS spice-client-win +2 8.10-3.el8_6.1 RHSA-2026:0076
RHEL 8.4 EUS Long Life lemon +4 3.26.0-13.el8_4.1 RHSA-2025:12905
RHEL 8.4 EUS Long Life spice-client-win +2 8.10-3.el8_4.1 RHSA-2026:0077
RHEL 8.4 AUS lemon +4 3.26.0-13.el8_4.1 RHSA-2025:12905
RHEL 8.4 AUS spice-client-win +2 8.10-3.el8_4.1 RHSA-2026:0077
RHEL 8.2 AUS lemon +4 3.26.0-6.el8_2.1 RHSA-2025:12901
RHEL 8.2 AUS spice-client-win +2 8.10-3.el8_2.1 RHSA-2026:0078
RHEL 7 ELS lemon +4 3.7.17-9.el7_9.1 RHSA-2025:12349

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 sqlite +2 3.46.1-5.el10_0 ALSA-2025:11933
AlmaLinux 9 sqlite +2 3.34.1-8.el9_6 ALSA-2025:20936, ALSA-2025:11992
AlmaLinux 8 lemon +4 3.26.0-20.el8_10 ALSA-2025:12010
AlmaLinux 8 mingw32-sqlite +3 3.26.0.0-2.el8_10 ALSA-2025:14101
AlmaLinux 8 nodejs +4 1:22.16.0-2.module_el8.10.0+4028+97ddca84 ALSA-2025:11803
AlmaLinux 8 nodejs-nodemon 3.0.1-1.module_el8.10.0+3983+391a1a04 ALSA-2025:11803
AlmaLinux 8 nodejs-packaging 2021.06-4.module_el8.10.0+4006+3c416519 ALSA-2025:11803
AlmaLinux 8 nodejs-packaging-bundler 2021.06-4.module_el8.10.0+3961+6a788e57 ALSA-2025:11803
AlmaLinux 8 npm 1:10.9.2-1.22.16.0.2.module_el8.10.0+4028+97ddca84 ALSA-2025:11803
AlmaLinux 8 v8-12.4-devel 3:12.4.254.21-1.22.16.0.2.module_el8.10.0+4028+97ddca84 ALSA-2025:11803

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 sqlite 3.46.1-5.el10_0 RLSA-2025:11933
Rocky Linux 9 nodejs 1:22.16.0-2.module+el9.6.0+32322+a8b1fd01 RLSA-2025:11802
Rocky Linux 9 nodejs-nodemon 3.0.1-1.module+el9.5.0+31770+0da7192d RLSA-2025:11802
Rocky Linux 9 nodejs-packaging 2021.06-4.module+el9.5.0+31770+0da7192d RLSA-2025:11802
Rocky Linux 9 sqlite 3.34.1-8.el9_6 RLSA-2025:20936, RLSA-2025:11992
Rocky Linux 8 mingw-sqlite 3.26.0.0-2.el8_10 RLSA-2025:14101
Rocky Linux 8 nodejs 1:22.16.0-2.module+el8.10.0+2012+fb8b67c7 RLSA-2025:11803
Rocky Linux 8 nodejs-nodemon 3.0.1-1.module+el8.9.0+1760+903d54b9 RLSA-2025:11803
Rocky Linux 8 nodejs-packaging 2021.06-4.module+el8.9.0+1419+1f26ef47 RLSA-2025:11803
Rocky Linux 8 sqlite 3.26.0-20.el8_10 RLSA-2025:12010
ReleasePackageFixed inAdvisory
SLES 15 SP7 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLES 15 SP6 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLES 15 SP5 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLES 15 SP4 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLES 15 SP3 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
Show 17 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 sqlite3 3.50.2-9.41.1 SUSE-SU-2025:02744-1
SLES for SAP 15 SP5 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLES for SAP 15 SP4 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLES for SAP 15 SP3 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLE Micro 6.1 sqlite3 3.50.2-slfo.1.1_1.1 SUSE-SU-2025:20674-1
SLE Micro 6.0 sqlite3 3.50.2-1.1 SUSE-SU-2025:20561-1
SLE Micro 5.5 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLE Micro 5.4 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLE Micro 5.3 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLE Micro 5.2 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLE Micro 5.1 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLE HPC 15 SP5 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLE HPC 15 SP4 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SLE HPC 15 SP3 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SUSE Manager Server LTS 4.3 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SUSE Manager Proxy LTS 4.3 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
SUSE Enterprise Storage 7.1 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed sqlite3 3.50.3-1.1 openSUSE-SU-2025:15368-1
openSUSE Leap 15.6 sqlite3 3.50.2-150000.3.33.1 SUSE-SU-2025:02672-1
ReleasePackageFixed inAdvisory
Alpine v3.24 qt6-qtwebengine 6.10.0-r1 —
Alpine v3.23 qt6-qtwebengine 6.10.0-r1 —
Alpine v3.22 qt6-qtwebengine 6.8.3-r4 —
Alpine v3.22 sqlite 3.49.2-r1 —
Alpine v3.21 sqlite 3.48.0-r3 —
Alpine v3.20 sqlite 3.45.3-r3 —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 sqlite 3.44.2-r2 —
Alpine v3.18 sqlite 3.41.2-r4 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 lemon +7 3.40.0-1.amzn2023.0.6 ALAS2023-2025-1151
Amazon Linux 2023 nodejs22 +4 1:22.18.0-1.amzn2023.0.1 ALAS2023-2025-1137
Amazon Linux 2023 nodejs22-npm 1:10.9.3-1.22.18.0.1.amzn2023.0.1 ALAS2023-2025-1137
Amazon Linux 2023 rust +14 1.89.0-1.amzn2023.0.2 ALAS2023-2025-1162
Amazon Linux 2023 v8-12.4-devel 3:12.4.254.21-1.22.18.0.1.amzn2023.0.1 ALAS2023-2025-1137
Amazon Linux 2 lemon +4 3.7.17-8.amzn2.1.3 ALAS2-2025-2973
Amazon Linux 2 rust +11 1.86.0-1.amzn2.0.3 ALAS2-2025-2978
Amazon Linux 2 thunderbird 128.11.1-1.amzn2.0.2 ALAS2-2025-2949

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 sqlite 3.44.0-2 —
Azure Linux 2 (CBL-Mariner) sqlite 3.39.2-4 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 sqlite +2 3.46.1-5.el10_0 ELSA-2025-11933
Oracle Linux 9 nodejs +4 1:22.16.0-2.module+el9.6.0+90635+2adf922b ELSA-2025-11802
Oracle Linux 9 nodejs-nodemon 3.0.1-1.module+el9.6.0+90635+2adf922b ELSA-2025-11802
Oracle Linux 9 nodejs-packaging +1 2021.06-4.module+el9.6.0+90635+2adf922b ELSA-2025-11802
Oracle Linux 9 npm 1:10.9.2-1.22.16.0.2.module+el9.6.0+90635+2adf922b ELSA-2025-11802
Oracle Linux 9 sqlite +2 3.34.1-8.el9_6 ELSA-2025-20936, ELSA-2025-11992
Oracle Linux 9 v8-12.4-devel 3:12.4.254.21-1.22.16.0.2.module+el9.6.0+90635+2adf922b ELSA-2025-11802
Oracle Linux 8 lemon +4 3.26.0-20.el8_10 ELSA-2025-12010
Oracle Linux 8 mingw32-sqlite +3 3.26.0.0-2.el8_10 ELSA-2025-14101
Oracle Linux 8 nodejs +4 1:22.16.0-2.module+el8.10.0+90633+72602921 ELSA-2025-11803
Oracle Linux 8 nodejs-nodemon 3.0.1-1.module+el8.10.0+90633+72602921 ELSA-2025-11803
Oracle Linux 8 nodejs-packaging +1 2021.06-4.module+el8.10.0+90633+72602921 ELSA-2025-11803
Oracle Linux 8 npm 1:10.9.2-1.22.16.0.2.module+el8.10.0+90633+72602921 ELSA-2025-11803
Oracle Linux 8 v8-12.4-devel 3:12.4.254.21-1.22.16.0.2.module+el8.10.0+90633+72602921 ELSA-2025-11803
Oracle Linux 7 lemon +4 3.7.17-8.0.1.el7_9.1 ELSA-2025-12349

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling jellyfin 12.0-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet SQLitePCLRaw.lib.e_sqlite3 <= 2.1.11 — GHSA-2m69-gcr7-jv3q
NuGet SQLitePCLRaw.lib.e_sqlite3.android <= 2.1.11 — GHSA-2m69-gcr7-jv3q
NuGet SQLitePCLRaw.lib.e_sqlite3.ios <= 2.1.11 — GHSA-2m69-gcr7-jv3q

Advisories 50

References