AZL-111781: CVE-2026-119377 affecting package sqlite 3.44.0-4

Q: Who is exposed to this issue?

Applications using affected SQLite versions are exposed if they rely on sqlite3_set_authorizer() SQLITE_READ restrictions to prevent access to specific columns and allow an attacker to submit SQL queries.

Q: What does an attacker need to exploit the bypass?

The attacker needs the ability to submit SQL and must use a RIGHT JOIN or FULL JOIN that references a shared USING column. The bypass can expose columns that the application's authorizer configuration denies for reading.

Q: Are default SQLite deployments affected?

The issue depends on use of sqlite3_set_authorizer() with SQLITE_READ restrictions. The provided information does not indicate that SQLite is vulnerable in deployments that do not use those authorizer-based column access controls.

Q: What version addresses the issue?

SQLite versions before 3.54.0 are affected. Updating to SQLite 3.54.0 or later addresses the described vulnerability.

Published Oct 30, 2026

Updated

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3setauthorizer() SQLITEREAD restrictions.

Affected Software

1 affected component

azure-linux/sqlite<=3.44.0-4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade sqlite to a version that resolves this vulnerability.
Fixed in 3.54.0Patch CVE-2026-119377

Event History

Oct 30, 2026

Advisory Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-119377

Frequently Asked Questions

Who is exposed to this issue?

Applications using affected SQLite versions are exposed if they rely on sqlite3_set_authorizer() SQLITE_READ restrictions to prevent access to specific columns and allow an attacker to submit SQL queries.

What does an attacker need to exploit the bypass?

The attacker needs the ability to submit SQL and must use a RIGHT JOIN or FULL JOIN that references a shared USING column. The bypass can expose columns that the application's authorizer configuration denies for reading.

Are default SQLite deployments affected?

The issue depends on use of sqlite3_set_authorizer() with SQLITE_READ restrictions. The provided information does not indicate that SQLite is vulnerable in deployments that do not use those authorizer-based column access controls.

What version addresses the issue?

SQLite versions before 3.54.0 are affected. Updating to SQLite 3.54.0 or later addresses the described vulnerability.

AZL-111781: CVE-2026-119377 affecting package sqlite 3.44.0-4

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the bypass?

Are default SQLite deployments affected?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the bypass?

Are default SQLite deployments affected?

What version addresses the issue?