CVE-2019-19926: SQL Injection
Last updated 25 August 2025
Other sources
multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
— Launchpad
SQLite is vulnerable to a denial of service, caused by the mishandling of certain errors during parsing in the multiSelect function in select.c. By sending specially-crafted sqlite3WindowRewrite() calls, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 120.0.6099.224-1~deb11u1Fixed in 150.0.7871.100-1~deb12u1Fixed in 150.0.7871.124-1~deb12u1Fixed in 150.0.7871.100-1~deb13u1Fixed in 150.0.7871.114-1~deb13u1Fixed in 150.0.7871.114-1Fixed in 150.0.7871.124-1 - Upgrade
Upgrade
debian/sqlite3to a version that resolves this vulnerability.Fixed in 3.34.1-3Fixed in 3.34.1-3+deb11u1Fixed in 3.40.1-2+deb12u2Fixed in 3.46.1-7+deb13u1Fixed in 3.46.1-9Fixed in 3.53.3-1
Event History
Frequently Asked Questions
What is CVE-2019-19926?
CVE-2019-19926 is a vulnerability in SQLite that allows a remote attacker to cause a denial of service by exploiting certain errors during parsing.
What is the severity of CVE-2019-19926?
The severity of CVE-2019-19926 is high, with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-19926?
The affected software versions include SQLite 3.30.1.
How can I fix CVE-2019-19926?
To fix CVE-2019-19926, apply the patch provided by the vendor or upgrade to a non-vulnerable version of the software.
Where can I find more information about CVE-2019-19926?
You can find more information about CVE-2019-19926 at the references provided: https://access.redhat.com/security/cve/CVE-2019-19880, https://github.com/sqlite/sqlite/commit/8428b3b437569338a9d1e10c4cd8154acbe33089, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1789374