RHSA-2026:58936: Important: sqlite security update

Q: What must an attacker control to trigger these issues?

The vulnerabilities are triggered through crafted FTS5 full-text search data. The advisory does not specify how that data reaches an affected application or whether remote exploitation is possible.

Q: What impact can exploitation have?

The listed fixes address arbitrary code execution in SQLite, and one issue can also cause a crash through a heap-based buffer overflow in FTS5.

Q: Which installed components are covered by this update?

The advisory covers the SQLite packages, including sqlite, sqlite-libs, sqlite-devel, sqlite-analyzer, and the listed debug and debuginfo packages. It does not provide affected or fixed package version numbers.

Published Aug 24, 2026

Updated

SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server.Security Fix(es): sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

40 affected componentsFixes available

redhat/sqlite<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/lemon-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/lemon-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-analyzer-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-analyzer-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-debugsource<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-debugsource<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-devel<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-devel<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-libs<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-libs<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-libs-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-libs-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-tcl-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-tcl-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-tools-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-tools-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/lemon-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-analyzer-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-debugsource<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-devel<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-libs<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-libs-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-tcl-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/sqlite-tools-debuginfo<3.34.1-11.el9_8

3.34.1-11.el9_8

redhat/lemon-debuginfo<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

redhat/sqlite<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

redhat/sqlite-analyzer-debuginfo<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

redhat/sqlite-debuginfo<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

redhat/sqlite-debugsource<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

redhat/sqlite-devel<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

redhat/sqlite-libs<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

redhat/sqlite-libs-debuginfo<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

redhat/sqlite-tcl-debuginfo<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

redhat/sqlite-tools-debuginfo<3.34.1-11.el9_8.aa

3.34.1-11.el9_8.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/sqlite to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/lemon-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/sqlite-analyzer-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/sqlite-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/sqlite-debugsource to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/sqlite-devel to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/sqlite-libs to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/sqlite-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/sqlite-tcl-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/sqlite-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8
Upgrade
Upgrade redhat/lemon-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa
Upgrade
Upgrade redhat/sqlite to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa
Upgrade
Upgrade redhat/sqlite-analyzer-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa
Upgrade
Upgrade redhat/sqlite-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa
Upgrade
Upgrade redhat/sqlite-debugsource to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa
Upgrade
Upgrade redhat/sqlite-devel to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa
Upgrade
Upgrade redhat/sqlite-libs to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa
Upgrade
Upgrade redhat/sqlite-libs-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa
Upgrade
Upgrade redhat/sqlite-tcl-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa
Upgrade
Upgrade redhat/sqlite-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 3.34.1-11.el9_8.aa

Event History

Aug 24, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

What must an attacker control to trigger these issues?

The vulnerabilities are triggered through crafted FTS5 full-text search data. The advisory does not specify how that data reaches an affected application or whether remote exploitation is possible.

What impact can exploitation have?

The listed fixes address arbitrary code execution in SQLite, and one issue can also cause a crash through a heap-based buffer overflow in FTS5.

Which installed components are covered by this update?

The advisory covers the SQLite packages, including sqlite, sqlite-libs, sqlite-devel, sqlite-analyzer, and the listed debug and debuginfo packages. It does not provide affected or fixed package version numbers.

RHSA-2026:58936: Important: sqlite security update

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker control to trigger these issues?

What impact can exploitation have?

Which installed components are covered by this update?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to trigger these issues?

What impact can exploitation have?

Which installed components are covered by this update?