{"id":"CVE-2021-31239","aliases":["BELL-CVE-2021-31239","BIT-sqlite-2021-31239","DEBIAN-CVE-2021-31239","EUVD-2021-18151","GHSA-mv5m-45gv-gh97","UBUNTU-CVE-2021-31239"],"status":"published","title":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of...","description":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02447,"percentile":0.84562,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2023-05-09T00:00:00Z","modified":"2026-10-24T10:30:26Z","fixes":[{"ecosystem":"Bitnami","package":"sqlite","fixed_in":["3.35.5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sqlite3","fixed_in":["3.36.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlite3","fixed_in":["3.36.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlite3","fixed_in":["3.36.0-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"sqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"3.35.4"},{"fixed":"3.35.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-2"}]}]}],"products":[{"vendor":"siemens","product":"ruggedcom crossbow"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"sqlite","product":"sqlite"}],"references":[{"url":"https://www.sqlite.org/cves.html","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://www.sqlite.org/forum/forumpost/d9fce1a89b","tags":["x_transferred","Mitigation","web","report"]},{"url":"https://github.com/Tsiming/Vulnerabilities/blob/main/SQLite/CVE-2021-31239","tags":["x_transferred","Exploit","Patch","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230609-0010/","tags":["x_transferred","web","advisory"]},{"url":"https://security.gentoo.org/glsa/202311-03","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-472630.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31239","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73XUIHJ6UT75VFPDPLJOXJON7MVIKVZI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXFL4TDAH72PRCPD5UPZMJMKIMVOPLTI"},{"url":"https://security.netapp.com/advisory/ntap-20230609-0010"},{"url":"https://github.com/advisories/GHSA-mv5m-45gv-gh97"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-31239","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-31239","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-31239","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31239","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-31239","description":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-14T11:39:34.725Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:33:05.665371Z"}],"euvd":[{"id":"EUVD-2021-18151","description":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-14T11:39:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:16.356399Z"}],"ghsa":[{"id":"GHSA-mv5m-45gv-gh97","title":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of...","description":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.","status":"published","published":"2023-05-09T03:30:38Z","modified":"2026-10-14T12:31:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:13:24.188405Z"}],"nvd":[{"id":"CVE-2021-31239","description":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.","status":"published","published":"2023-05-09T02:15:08.907Z","modified":"2026-10-14T12:17:11.65Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"BELL-CVE-2021-31239","title":"CVE-2021-31239 does not affect BellSoft software","status":"withdrawn","published":"2023-05-09T02:15:00Z","modified":"2026-01-26T09:49:58.881933Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-31239","description":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.","status":"published","published":"2023-05-09T02:15:08.907Z","modified":"2026-10-24T10:30:26.768765756Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"DEBIAN-CVE-2021-31239","description":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.","status":"published","published":"2023-05-09T02:15:08.907Z","modified":"2026-10-15T09:47:28.083728916Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-31239","description":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.","status":"withdrawn","published":"2023-05-09T02:15:00Z","modified":"2025-07-16T07:42:39.293927Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"BIT-sqlite-2021-31239","description":"An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function.","status":"published","published":"2024-03-06T11:06:35.104Z","modified":"2026-09-08T08:48:19.484296884Z","updated_at":"2026-11-02T15:28:35.111822Z"}]}}