Description
Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | 3.53.2-1 | — |
| Debian 13 | sqlite3 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | sqlite3 | 3.46.1-9ubuntu0.3 | USN-8775-1 |
| Ubuntu 24.04 LTS | sqlite3 | 3.45.1-1ubuntu2.8 | USN-8775-1 |
| Ubuntu 22.04 LTS | sqlite | No fix yet | — |
| Ubuntu 22.04 LTS | sqlite3 | 3.37.2-2ubuntu0.8 | USN-8775-1 |
| Ubuntu 20.04 LTS | sqlite | No fix yet | — |
| Ubuntu 18.04 LTS | sqlite | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | sqlite | No fix yet | — |
| Ubuntu 14.04 LTS | sqlite | No fix yet | — |
| Ubuntu Pro 20.04 LTS | sqlite3 | 3.31.1-4ubuntu0.7+esm2 | USN-8775-1 |
| Ubuntu Pro 18.04 LTS | sqlite3 | 3.22.0-1ubuntu0.7+esm3 | USN-8775-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | lemon +8 | 3.53.4-1.hum1 | RHSA-2026:49665 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
20000419/CVE-2026-39113 ★ 0 · Aug 21, 2026
CVE-2026-39113: SQLite SQLAR heap-buffer-overflow advisory and reproducer
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2026:49665 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- USN-8775-1 sqlite3 vulnerability Ubuntu Security Notices (USN) · Sep 17, 2026
- WID-SEC-2026-3030 SQLite: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 16, 2026