{"id":"CVE-2021-3119","aliases":["EUVD-2021-26470","GHSA-r659-6fh2-v3gv"],"status":"published","title":"Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to...","description":"Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01558,"percentile":0.75419,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476","CWE-89"],"published":"2021-03-25T22:40:30Z","modified":"2026-10-20T14:22:38Z","products":[{"vendor":"zetetic","product":"sqlcipher"}],"references":[{"url":"https://www.telekom.com/resource/blob/621186/3fb50ca7a4a97728be18717ed7b0062c/dl-210308-critical-dos-vulnerability-in-sqlcipher-sql-command-processing-data.pdf","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","evidence"]},{"url":"https://github.com/sqlcipher/sqlcipher/commit/cb71f53e8cea4802509f182fa5bead0ac6ab0e7f#diff-9305215a9a0ea69300281fc4af90bc7f3437e34a0e1745d030213152993ddae4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3119"},{"url":"https://github.com/advisories/GHSA-r659-6fh2-v3gv"}],"sources":{"cve":[{"id":"CVE-2021-3119","description":"Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.","status":"published","published":"2021-03-25T22:40:30Z","modified":"2024-08-03T16:45:51.285Z","updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26470","description":"Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.","status":"published","published":"2021-03-25T22:40:30Z","modified":"2024-08-03T16:45:51Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-r659-6fh2-v3gv","title":"Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to...","description":"Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.","status":"published","published":"2022-05-24T17:45:34Z","modified":"2023-01-29T05:05:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-89","CWE-476"],"updated_at":"2026-11-02T14:45:52.34362Z"}],"nvd":[{"id":"CVE-2021-3119","description":"Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.","status":"published","published":"2021-03-25T23:15:13.257Z","modified":"2026-06-17T04:04:41.973Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:06:51.197859Z"}],"osv":[{"id":"CVE-2021-3119","description":"Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c. This may allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute the crafted SQL command sequence, which causes a segmentation fault.","status":"published","published":"2021-03-25T23:15:13.257Z","modified":"2026-10-20T14:22:38.083044776Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.483607Z"}]}}