Description
SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SQLite | SQLite | < 3.54.0 | 3.54.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | 3.54.1-1 | — |
| Debian 13 | sqlite3 | No fix yet | — |
| Debian 12 | sqlite3 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | sqlite3 | No fix yet | — |
| Ubuntu 26.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu 24.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu 22.04 LTS | sqlite +1 | No fix yet | — |
| Ubuntu 20.04 LTS | sqlite | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | sqlite | No fix yet | — |
| Ubuntu 16.04 LTS | sqlite | No fix yet | — |
| Ubuntu 14.04 LTS | sqlite | No fix yet | — |
| Ubuntu Pro 20.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | sqlite3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | lemon +8 | 3.54.1-1.hum1 | RHSA-2026:86202 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs +4 | 1:24.22.1-2.module_el8.10.0+4355+47fd9055 | ALSA-2026:98102 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:98102 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:98102 |
| AlmaLinux 8 | npm | 1:11.19.1-1.24.22.1.2.module_el8.10.0+4355+47fd9055 | ALSA-2026:98102 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.2.module_el8.10.0+4355+47fd9055 | ALSA-2026:98102 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:96226 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:98102 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:98102 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sqlite3 | 3.54.1-2.1 | openSUSE-SU-2026:12493-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs22 +4 | 1:22.23.5-1.amzn2023.0.1 | ALAS2023-2026-3456 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.9-1.22.23.5.1.amzn2023.0.1 | ALAS2023-2026-3456 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.22.3-1.amzn2023.0.1 | ALAS2023-2026-3457 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.3.1.amzn2023.0.1 | ALAS2023-2026-3457 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.5.1.amzn2023.0.1 | ALAS2023-2026-3456 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.3.1.amzn2023.0.1 | ALAS2023-2026-3457 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | sqlite | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | nodejs +4 | 1:24.21.0-1.0.1.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-6.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-96226 |
| Oracle Linux 9 | npm | 1:11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91109+154e6434 | ELSA-2026-96226 |
Advisories 9
- RHSA-2026:86202 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ALSA-2026:98102 Important: nodejs:24 security update AlmaLinux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4260 SQLite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALAS2023-2026-3456 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3457 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- RLSA-2026:98102 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 11, 2026
- RLSA-2026:96226 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 10, 2026
- openSUSE-SU-2026:12493-1 lemon-3.54.1-2.1 on GA media SUSE / openSUSE Security Updates · Nov 9, 2026
- ELSA-2026-96226 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
References
- https://sqlite.org/bugs/info/2026-08-16T10:15:25Z issue-tracking
- https://sqlite.org/src/info/3f57024aecea0f3b patch
- https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52 patch
- https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619 technical-description
- https://sqlite.org/releaselog/3_54_0.html release-notes
- https://abraxaslabs.tech/research/sqlite-session-ncol third-party-advisory
- https://github.com/sqlite/sqlite product
- VulnCheck Advisory: SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind() third-party-advisory