Threats affecting pkg:github/SQLite

SQLite versions prior to 3.54.0 contain a stack exhaustion vulnerability in the countOfViewOptimization() function. This flaw can be triggered by attackers using a crafted SQL query or database file with a deeply nested TK_PLUS expression, causing recursive freeing operations that exhaust the C stack and crash the host process, resulting in denial of service.

SQLite command-line shell versions up to 3.54.1 have a command injection vulnerability in the .recover command. This flaw allows attackers to craft a malicious database schema containing specially crafted dot-commands that get executed as OS commands when the .recover output is piped into sqlite3.

SQLite versions prior to 3.54.0 that are built with the session extension contain a heap buffer overflow vulnerability in the sqlite3changeset_apply() function. This flaw allows attackers to corrupt heap memory by crafting changesets that repeat a table name with a larger column count, causing a buffer overflow in sessionUpdateFind(). The vulnerability is fixed in version 3.54.0.

CVE-2026-119378 is a use-after-free vulnerability in SQLite versions before 3.54.0 affecting the R-Tree extension. It arises when attackers manipulate the %_node shadow table, causing applications to use freed heap memory. This can lead to process crashes after node splits due to improper hashing in nodeWrite().

SQLite versions prior to 3.54.0 contain an authorization bypass vulnerability in the lookupName() function. This flaw causes the authorizer callback to be invoked only for the first joined table's USING column, allowing attackers who can submit SQL to bypass SQLITE_READ restrictions on shared USING columns in RIGHT or FULL JOIN queries.

SQLite versions prior to 3.54.0 contain a stack exhaustion vulnerability due to uncontrolled recursion triggered by chaining COLLATE postfix operators. This allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by supplying approximately 175,000 chained COLLATE operators in SQL statements or untrusted database views, causing unbounded recursion in the sqlite3WalkExprNN() function and crashing the process.

SQLite versions prior to 3.54.0 contain an information disclosure vulnerability where attackers can read uninitialized page-cache memory by supplying a Write-Ahead Logging (WAL) file with an undersized page size. This crafted database and WAL file can cause queries like substr() to return stale bytes, potentially disclosing data from other table rows and internal pointers.

CVE-2026-119374 is a heap buffer overflow vulnerability in SQLite versions before 3.54.0 when built with FTS5 and secure-delete enabled. The flaw exists in the fts5DoSecureDelete() function, where crafted footer key offsets in a corrupted FTS5 index can cause out-of-bounds writes past the leaf page buffer. This can lead to heap memory corruption and application crashes.

CVE-2026-119373 is a heap buffer overflow vulnerability in SQLite versions before 3.54.0 when built with FTS5 enabled. The flaw occurs in the fts5MergeRowidLists() function, which undersizes the output buffer during merging of detail=none prefix doclists. An attacker able to insert negative rowids into a detail=none FTS5 table and execute a prefix MATCH query can trigger out-of-bounds writes, leading to heap corruption and process crashes.

CVE-2026-119372 is a use-after-free vulnerability in SQLite versions prior to 3.54.0 when built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS enabled. The flaw exists in the fts3BestSnippet() function due to dangling cached position-list pointers. An attacker can exploit this by running a full-text MATCH query combining OR and NEAR operators with snippet(), potentially causing the process to read freed heap memory and crash.

SQLite versions prior to 3.54.0 contain a stack exhaustion vulnerability due to uncontrolled recursion in the handling of common table expressions (CTEs). This flaw allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit by supplying a WITH clause with tens of thousands of chained CTEs, causing unbounded recursion in selectExpander() and crashing the process.