CVE-2019-19244: SQL Injection
Last updated 25 August 2025
Other sources
SQLite is vulnerable to a denial of service, caused by an error in sqlite3Select in select.c. By providing specially crafted input, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/sqliteto a version that resolves this vulnerability.Fixed in 3.31.0 - Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.34.1-3Fixed in 3.34.1-3+deb11u1Fixed in 3.40.1-2+deb12u2Fixed in 3.46.1-7+deb13u1Fixed in 3.53.3-1 - Upgrade
Upgrade
sqliteto a version that resolves this vulnerability.Fixed in 3.30.1Patch e59c562b3f6894f84c715772c4b116d7b5c01348
Event History
Frequently Asked Questions
What is CVE-2019-19244?
CVE-2019-19244 is a vulnerability in SQLite that allows a remote attacker to cause a denial of service by crashing the application.
How severe is CVE-2019-19244?
CVE-2019-19244 has a severity rating of 7.5, which is considered high.
Which software versions are affected by CVE-2019-19244?
CVE-2019-19244 affects the following software versions: SQLite 3.30.1, sqlite3 up to 3.27.2-3+deb10u2, sqlite3 up to 3.43.2-1, and other specific versions of SQLite and related products.
How can I fix CVE-2019-19244?
To fix CVE-2019-19244, you should update to the latest version of SQLite or apply the patches provided by the vendor.
Where can I find more information about CVE-2019-19244?
You can find more information about CVE-2019-19244 on MITRE's CVE website, Ubuntu Security Notices, and the NIST NVD website.