Description
SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SQLite | SQLite | < 3.54.0 | 3.54.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | 3.54.1-1 | — |
| Debian 13 | sqlite3 | No fix yet | — |
| Debian 12 | sqlite3 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | sqlite3 | No fix yet | — |
| Ubuntu 26.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu 24.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu 22.04 LTS | sqlite +1 | No fix yet | — |
| Ubuntu 20.04 LTS | sqlite | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | sqlite | No fix yet | — |
| Ubuntu 16.04 LTS | sqlite | No fix yet | — |
| Ubuntu 14.04 LTS | sqlite | No fix yet | — |
| Ubuntu Pro 20.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | sqlite3 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sqlite3 | 3.54.1-2.1 | openSUSE-SU-2026:12493-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | lemon +7 | 3.40.0-1.amzn2023.0.9 | ALAS2023-2026-3452 |
| Amazon Linux 2023 | nodejs22 +4 | 1:22.23.5-1.amzn2023.0.1 | ALAS2023-2026-3456 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.9-1.22.23.5.1.amzn2023.0.1 | ALAS2023-2026-3456 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.22.3-1.amzn2023.0.1 | ALAS2023-2026-3457 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.3.1.amzn2023.0.1 | ALAS2023-2026-3457 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.5.1.amzn2023.0.1 | ALAS2023-2026-3456 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.3.1.amzn2023.0.1 | ALAS2023-2026-3457 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | sqlite | No fix yet | — |
Advisories 5
- WID-SEC-2026-4260 SQLite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALAS2023-2026-3452 Moderate: sqlite security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3456 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3457 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- openSUSE-SU-2026:12493-1 lemon-3.54.1-2.1 on GA media SUSE / openSUSE Security Updates · Nov 9, 2026
References
- https://sqlite.org/bugs/info/2026-08-17T09:18:24Z issue-tracking
- https://sqlite.org/src/info/e4635c4153 patch
- https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731 patch
- https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561 technical-description
- https://sqlite.org/releaselog/3_54_0.html release-notes
- https://abraxaslabs.tech/research/sqlite-fts3-snippet third-party-advisory
- https://github.com/sqlite/sqlite product
- VulnCheck Advisory: SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet() third-party-advisory