CVE-2019-19926: SQL Injection
Last updated 25 August 2025
Other sources
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
— Launchpad
SQLite is vulnerable to a denial of service, caused by the mishandling of certain errors during parsing in the multiSelect function in select.c. By sending specially-crafted sqlite3WindowRewrite() calls, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-19926?
CVE-2019-19926 is a vulnerability in SQLite that allows a remote attacker to cause a denial of service by exploiting certain errors during parsing.
What is the severity of CVE-2019-19926?
The severity of CVE-2019-19926 is high, with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-19926?
The affected software versions include SQLite 3.30.1.
How can I fix CVE-2019-19926?
To fix CVE-2019-19926, apply the patch provided by the vendor or upgrade to a non-vulnerable version of the software.
Where can I find more information about CVE-2019-19926?
You can find more information about CVE-2019-19926 at the references provided: https://access.redhat.com/security/cve/CVE-2019-19880, https://github.com/sqlite/sqlite/commit/8428b3b437569338a9d1e10c4cd8154acbe33089, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1789374