Every CVE Search/ Get API key

CVE-2026-50813

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain...

6.1 MediumFix available

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
High

Exploit likelihood

0.16%Unchanged since Jul 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

Record
CVE-2026-50813
CVSS 3.1
6.1 MediumCVSS:3.1/AC:L/AV:L/A:H/C:L/I:N/PR:N/S:U/UI:R
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-126
Updated
2026-11-02
EUVDEUVD-2026-42502 6.1

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

Record
EUVD-2026-42502
CVSS 3.1
6.1 MediumCVSS:3.1/AC:L/AV:L/A:H/C:L/I:N/PR:N/S:U/UI:R
Updated
2026-11-02
GitHub AdvisoriesGHSA-pp2q-fpvv-vr5h 6.1

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain...

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

Record
GHSA-pp2q-fpvv-vr5h
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Weakness
CWE-126
Updated
2026-11-02
NVD 6.1

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

Record
CVE-2026-50813
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-126
Updated
2026-11-02
OSVBELL-CVE-2026-50813 6.1
Record
BELL-CVE-2026-50813
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSV 6.1

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

Record
CVE-2026-50813
CVSS 3.1
6.1 MediumCVSS:3.1/AC:L/AV:L/A:H/C:L/I:N/PR:N/S:U/UI:R
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2026-50813 6.1

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

Record
DEBIAN-CVE-2026-50813
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3490 6.1

sqlite security update

SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.

Security Fix(es):

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path(CVE-2026-50813)

Record
OESA-2026-3490
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:23423 5.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:23423
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-50813 6.1

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

Record
UBUNTU-CVE-2026-50813
CVSS 3.1
6.1 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2026-0305 No score

Updated sqlite3 packages fix security vulnerabilities

CVE-2026-50812: A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.

CVE-2026-50813: An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path.

Record
MGASA-2026-0305
Updated
2026-11-02
OSVUSN-8565-1 No score

sqlite3 vulnerabilities

It was discovered that SQLite did not properly handle NULL pointer dereferences in the Session Extension when applying a corrupt changeset. An attacker could possibly use this issue to cause SQLite to crash, resulting in a denial of service. (CVE-2026-50812)

It was discovered that SQLite had a buffer overread in the Session Extension when processing a corrupt changeset. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-50813)

Record
USN-8565-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
sqlite
Alpaquita:23
 3.40.0-r0 and later None known
sqlite
Alpaquita:25
 3.49.2-r0 and later None known
sqlite
Alpaquita:stream
 3.41.1-r0 and later None known
sqlite
BellSoft Hardened Containers:23
 3.40.0-r0 and later None known
sqlite
BellSoft Hardened Containers:25
 3.49.2-r0 and later None known
sqlite
BellSoft Hardened Containers:stream
 3.41.1-r0 and later None known
sqlite3
Debian:12
 All versions, plus listed versions
3.40.1-23.40.1-2+deb12u13.40.1-2+deb12u23.42.0-13.43.0-1
Show 24 moreShow less
3.43.1-13.43.2-13.44.0-13.44.2-13.45.0-13.45.1-13.45.2-13.45.3-13.45.3-2~exp13.46.0-13.46.1-13.46.1-23.46.1-2~exp3.46.1-33.46.1-43.46.1-53.46.1-63.46.1-73.46.1-83.46.1-93.53.2-13.53.3-13.53.4-13.53.4-2
 None known
sqlite3
Debian:13
 All versions, plus listed versions
3.46.1-73.46.1-7+deb13u13.46.1-7+deb13u23.46.1-83.46.1-9
Show 4 moreShow less
3.53.2-13.53.3-13.53.4-13.53.4-2
 None known
sqlite3
Debian:14
 before 3.53.4-2, plus listed versions
3.46.1-73.46.1-83.46.1-93.53.2-13.53.3-13.53.4-1
3.53.4-2
sqlite3
Mageia:10
From an advisory covering 2 CVEs
 before 3.51.3-1.2.mga10
3.51.3-1.2.mga10
Show 31 moreShow less
Affected packages
PackageAffectedFixed
sqlite3
Mageia:9
From an advisory covering 2 CVEs
 before 3.40.1-1.10.mga9
3.40.1-1.10.mga9
sqlite
openEuler:24.03-LTS-SP4
 before 3.42.0-8.oe2403sp4
3.42.0-8.oe2403sp4
sqlite
openEuler:20.03-LTS-SP4
 before 3.32.3-10.oe2003sp4
3.32.3-10.oe2003sp4
sqlite
openEuler:22.03-LTS-SP4
 before 3.37.2-10.oe2203sp4
3.37.2-10.oe2203sp4
sqlite
openEuler:24.03-LTS-SP1
 before 3.42.0-8.oe2403sp1
3.42.0-8.oe2403sp1
sqlite
openEuler:24.03-LTS-SP3
 before 3.42.0-8.oe2403sp3
3.42.0-8.oe2403sp3
lemon
Red Hat:hummingbird:1
 before 0:3.53.2-1.hum1
0:3.53.2-1.hum1
sqlite
Red Hat:hummingbird:1
 before 0:3.53.2-1.hum1
0:3.53.2-1.hum1
sqlite-analyzer
Red Hat:hummingbird:1
 before 0:3.53.2-1.hum1
0:3.53.2-1.hum1
sqlite-debug
Red Hat:hummingbird:1
 before 0:3.53.2-1.hum1
0:3.53.2-1.hum1
sqlite-devel
Red Hat:hummingbird:1
 before 0:3.53.2-1.hum1
0:3.53.2-1.hum1
sqlite-doc
Red Hat:hummingbird:1
 before 0:3.53.2-1.hum1
0:3.53.2-1.hum1
sqlite-libs
Red Hat:hummingbird:1
 before 0:3.53.2-1.hum1
0:3.53.2-1.hum1
sqlite-tcl
Red Hat:hummingbird:1
 before 0:3.53.2-1.hum1
0:3.53.2-1.hum1
sqlite-tools
Red Hat:hummingbird:1
 before 0:3.53.2-1.hum1
0:3.53.2-1.hum1
sqlite
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.8.17-8fakesync12.8.17-9fakesync12.8.17-10ubuntu2
 None known
sqlite3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.7.17-1ubuntu13.8.0.2-1ubuntu13.8.1-1ubuntu13.8.1-1ubuntu33.8.2-1ubuntu1
Show 8 moreShow less
3.8.2-1ubuntu23.8.2-1ubuntu2.13.8.2-1ubuntu2.23.8.2-1ubuntu2.2+esm13.8.2-1ubuntu2.2+esm23.8.2-1ubuntu2.2+esm33.8.2-1ubuntu2.2+esm43.8.2-1ubuntu2.2+esm5
 None known
sqlite3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.8.11.1-13.9.1-23.9.2-13.10.0-13.10.1-1
Show 10 moreShow less
3.10.2-13.11.0-1ubuntu13.11.0-1ubuntu1.13.11.0-1ubuntu1.23.11.0-1ubuntu1.33.11.0-1ubuntu1.43.11.0-1ubuntu1.53.11.0-1ubuntu1.5+esm13.11.0-1ubuntu1.5+esm23.11.0-1ubuntu1.5+esm3
 None known
sqlite
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.8.17-12fakesync1
 None known
sqlite3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.19.3-33.20.1-23.21.0-13.22.0-13.22.0-1ubuntu0.1
Show 9 moreShow less
3.22.0-1ubuntu0.23.22.0-1ubuntu0.33.22.0-1ubuntu0.43.22.0-1ubuntu0.53.22.0-1ubuntu0.63.22.0-1ubuntu0.73.22.0-1ubuntu0.7+esm13.22.0-1ubuntu0.7+esm23.22.0-1ubuntu0.7+esm3
 None known
sqlite
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.17-14fakesync1
 None known
sqlite3
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
3.29.0-23.30.1-13.30.1-1ubuntu13.31.1-1ubuntu13.31.1-3
Show 10 moreShow less
3.31.1-43.31.1-4ubuntu0.13.31.1-4ubuntu0.23.31.1-4ubuntu0.33.31.1-4ubuntu0.43.31.1-4ubuntu0.53.31.1-4ubuntu0.63.31.1-4ubuntu0.73.31.1-4ubuntu0.7+esm13.31.1-4ubuntu0.7+esm2
 None known
sqlite
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.8.17-15fakesync1build1
 None known
sqlite
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.8.17-15fakesync1build1
 None known
sqlite3
Ubuntu:22.04:LTS
 before 3.37.2-2ubuntu0.7, plus listed versions
3.35.5-13.36.0-23.37.2-23.37.2-2ubuntu0.13.37.2-2ubuntu0.33.37.2-2ubuntu0.43.37.2-2ubuntu0.53.37.2-2ubuntu0.6
3.37.2-2ubuntu0.7
sqlite3
Ubuntu:24.04:LTS
 before 3.45.1-1ubuntu2.7, plus listed versions
3.42.0-13.44.0-13.44.2-13.45.0-13.45.1-1
Show 7 moreShow less
3.45.1-1ubuntu13.45.1-1ubuntu23.45.1-1ubuntu2.13.45.1-1ubuntu2.33.45.1-1ubuntu2.43.45.1-1ubuntu2.53.45.1-1ubuntu2.6
3.45.1-1ubuntu2.7
sqlite3
Ubuntu:25.10
 All versions, plus listed versions
3.46.1-33.46.1-43.46.1-63.46.1-6ubuntu13.46.1-73.46.1-7build13.46.1-83.46.1-8ubuntu0.1
 None known
sqlite3
Ubuntu:26.04:LTS
 before 3.46.1-9ubuntu0.2, plus listed versions
3.46.1-83.46.1-93.46.1-9ubuntu0.1
3.46.1-9ubuntu0.2
sqlite3
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 3.37.2-2ubuntu0.7, plus listed versions
3.35.5-13.36.0-23.37.2-23.37.2-2ubuntu0.13.37.2-2ubuntu0.33.37.2-2ubuntu0.43.37.2-2ubuntu0.53.37.2-2ubuntu0.6
3.37.2-2ubuntu0.7
sqlite3
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 3.45.1-1ubuntu2.7, plus listed versions
3.42.0-13.44.0-13.44.2-13.45.0-13.45.1-1
Show 7 moreShow less
3.45.1-1ubuntu13.45.1-1ubuntu23.45.1-1ubuntu2.13.45.1-1ubuntu2.33.45.1-1ubuntu2.43.45.1-1ubuntu2.53.45.1-1ubuntu2.6
3.45.1-1ubuntu2.7
sqlite3
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 3.46.1-9ubuntu0.2, plus listed versions
3.46.1-83.46.1-93.46.1-9ubuntu0.1
3.46.1-9ubuntu0.2

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-50813 is a medium vulnerability (CVSS 6.1) in sqlite, published July 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in sqlite3 3.53.4-2.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open