CVE-2026-11822

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.

SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.

Security Fix(es):

SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.(CVE-2026-11822)

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.(CVE-2026-11824)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

• brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

• ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

• brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

• ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

• brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

• brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

• ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

• brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

• brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

• ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

• brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)

• ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)

• brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

• ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Version 2 and version 3 binaries are named to permit each to be installed on a single host This package contains cross-compiled libraries and development tools for Windows.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
• brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
• ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
• brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
• ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
• brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
• brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
• ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
• brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
• brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
• ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
• brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
• ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
• brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
• ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Version 2 and version 3 binaries are named to permit each to be installed on a single host This package contains cross-compiled libraries and development tools for Windows.

Security Fix(es):

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in the leaf page so that fts5LeafSeek() reads past the end of the page buffer while comparing terms during an FTS5 MATCH query, in applications compiled with SQLITE_ENABLE_FTS5.

SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.

• SECURITY UPDATE: heap buffer overflow in FTS5 corrupt-record handling
  • debian/patches/CVE-2026-11822-and-11824.patch: reject leaf pages with szLeaf < 4 in fts5LeafRead() in ext/fts5/fts5_index.c, closing the out-of-bounds read / heap buffer overflow paths in fts5ChunkIterate() and fts5LeafSeek().
  • CVE-2026-11822
  • CVE-2026-11824

• CVE-2026-11824: reject fts5 leaf pages with szLeaf < 4 to prevent a heap buffer overflow on corrupt records
• CVE-2026-11822: bound fts5 column-list nPos by the configured column count to prevent an output poslist buffer overrun

• CVE-2026-11822: fix memory corruption in FTS5 fts5LeafRead() by rejecting leaf pages with szLeaf < 4, blocking the OOB read in fts5LeafSeek()
• CVE-2026-11824: fix heap-based buffer overflow via integer underflow in fts5ChunkIterate() when szLeaf < 4 (same root cause; closed by the same fts5LeafRead validation tightening)

• CVE-2026-11822: fix memory corruption in FTS5 fts5LeafRead() by rejecting leaf pages with szLeaf < 4, blocking the OOB read in fts5LeafSeek()
• CVE-2026-11824: fix heap-based buffer overflow via integer underflow in fts5ChunkIterate() when szLeaf < 4 (same root cause; closed by the same fts5LeafRead validation tightening)

• CVE-2026-11822: fix memory corruption in FTS5 fts5LeafRead() by rejecting leaf pages with szLeaf < 4, blocking the OOB read in fts5LeafSeek()
• CVE-2026-11824: fix heap-based buffer overflow via integer underflow in fts5ChunkIterate() when szLeaf < 4 (same root cause; closed by the same fts5LeafRead validation tightening)

• CVE-2026-11822: fix memory corruption in FTS5 fts5LeafRead() by rejecting leaf pages with szLeaf < 4, blocking the OOB read in fts5LeafSeek()
• CVE-2026-11824: fix heap-based buffer overflow via integer underflow in fts5ChunkIterate() when szLeaf < 4 (same root cause; closed by the same fts5LeafRead validation tightening)

• SECURITY UPDATE: memory corruption in FTS5 full-text search extension
  • debian/patches/CVE-2026-11822-and-11824.patch: tighten leaf-page validation in fts5LeafRead() to reject pages with szLeaf < 4. Closes both the OOB read in fts5LeafSeek() (CVE-2026-11822) and the heap buffer overflow via integer underflow in fts5ChunkIterate() (CVE-2026-11824) at a single chokepoint.
  • CVE-2026-11822
  • CVE-2026-11824

• SECURITY UPDATE: heap buffer overflow in FTS5 corrupt-record handling
  • debian/patches/CVE-2026-11822-and-11824.patch: reject leaf pages with szLeaf < 4 in fts5LeafRead() in ext/fts5/fts5_index.c, closing the out-of-bounds read / heap buffer overflow paths in fts5ChunkIterate() and fts5LeafSeek().
  • CVE-2026-11822
  • CVE-2026-11824

The updated packages fix security vulnerabilities: SQLite before 3.53.2 Memory Corruption in FTS5 Extension. (CVE-2026-11822) SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate. (CVE-2026-11824)