Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
SQLite library may leak data to local attacker
published 2 months ago
Summary
If your systems use SQLite versions older than the recent update, a local user could potentially read sensitive information stored in the database. This risk comes from a flaw in how SQLite merges certain data changes. Update SQLite to the latest version to close this gap and protect your data.
What to do
- Update openeuler sqlite to version 3.42.0-8.oe2403sp3.
- Update openeuler sqlite to version 3.32.3-10.oe2003sp4.
- Update openeuler sqlite to version 3.37.2-10.oe2203sp4.
- Update openeuler sqlite to version 3.42.0-8.oe2403sp1.
- Update openeuler sqlite to version 3.42.0-8.oe2403sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP3 | openeuler | sqlite |
< 3.42.0-8.oe2403sp3 Fix: upgrade to 3.42.0-8.oe2403sp3
|
| openEuler:20.03-LTS-SP4 | openeuler | sqlite |
< 3.32.3-10.oe2003sp4 Fix: upgrade to 3.32.3-10.oe2003sp4
|
| openEuler:22.03-LTS-SP4 | openeuler | sqlite |
< 3.37.2-10.oe2203sp4 Fix: upgrade to 3.37.2-10.oe2203sp4
|
| openEuler:24.03-LTS-SP1 | openeuler | sqlite |
< 3.42.0-8.oe2403sp1 Fix: upgrade to 3.42.0-8.oe2403sp1
|
| openEuler:24.03-LTS-SP4 | openeuler | sqlite |
< 3.42.0-8.oe2403sp4 Fix: upgrade to 3.42.0-8.oe2403sp4
|
Original advisory text
sqlite security update
SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.
Security Fix(es):
An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path(CVE-2026-50813)
Security Fix(es):
An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path(CVE-2026-50813)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-50813 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published20 Aug 2026
Updated21 Aug 2026
First seen21 Aug 2026
Sources
OESA-2026-3490 · OSV
Track software like this
Free during beta