Description
SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SQLite | SQLite | < 3.54.0 | 3.54.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | 3.54.1-1 | — |
| Debian 13 | sqlite3 | No fix yet | — |
| Debian 12 | sqlite3 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | sqlite3 | No fix yet | — |
| Ubuntu 26.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu 24.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu 22.04 LTS | sqlite +1 | No fix yet | — |
| Ubuntu 20.04 LTS | sqlite | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | sqlite | No fix yet | — |
| Ubuntu 16.04 LTS | sqlite | No fix yet | — |
| Ubuntu 14.04 LTS | sqlite | No fix yet | — |
| Ubuntu Pro 20.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | sqlite3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | lemon +8 | 3.54.1-1.hum1 | RHSA-2026:86202 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sqlite3 | 3.54.1-2.1 | openSUSE-SU-2026:12493-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | lemon +7 | 3.40.0-1.amzn2023.0.9 | ALAS2023-2026-3452 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | sqlite | No fix yet | — |
Advisories 4
- RHSA-2026:86202 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4260 SQLite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALAS2023-2026-3452 Moderate: sqlite security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- openSUSE-SU-2026:12493-1 lemon-3.54.1-2.1 on GA media SUSE / openSUSE Security Updates · Nov 9, 2026
References
- https://sqlite.org/bugs/info/2026-07-05T08:15:45Z issue-tracking
- https://sqlite.org/src/info/bbd69ce274620008 patch
- https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237 patch
- https://sqlite.org/src/info/2cb22877683680c1 patch
- https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8 patch
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775 technical-description
- https://sqlite.org/releaselog/3_54_0.html release-notes
- https://abraxaslabs.tech/research/sqlite-fj-using-auth third-party-advisory
- https://github.com/sqlite/sqlite product
- VulnCheck Advisory: SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING third-party-advisory