PatchTheCVEsqlite vulnerabilities and fixes
Recent CVEs affecting sqlite, with upgrade or downgrade steps. 6 tracked.
sqlite has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-03-12. Highest priority: CVE-2025-6965 (score 57/100).
- CVE-2025-70873 HIGH 7.5 UPGRADE An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and
- CVE-2025-6965 HIGH 7.7 UPGRADE UPGRADE There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed
- CVE-2025-3277 CRITICAL 9.8 UPGRADE An integer overflow can be triggered in SQLite’s `concat_ws()` function
- CVE-2025-29088 MEDIUM 5.6 DOWNGRADE In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause
- CVE-2025-29087 LOW 3.2 UPGRADE In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written bey
- CVE-2025-7458 CRITICAL 9.1 UPGRADE An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows
FAQ
How do I fix sqlite vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sqlite being exploited right now?
None of the tracked sqlite CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sqlite CVE should I patch first?
CVE-2025-6965 currently ranks highest (57/100): There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed.