products / sqlite

SQLite

SQLite is an embedded SQL engine used inside applications, browsers, and mobile OSes. NVD tracks it as sqlite:sqlite. CVE volume is lower than client-server databases but includes real memory-safety defects.

api usage

Querying SQLite

product slugsqlite

version format3.39.1, 3.45.0

bash

curl "https://api.attestd.io/v1/check?product=sqlite&version=3.39.1" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Spot-check CVE-2022-35737 (out-of-bounds read).risk_state may be low or high depending on synthesis flags. Verify live.

json

{
  "product": "sqlite",
  "version": "3.39.1",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2022-35737",
    "CVE-2022-46908",
    "CVE-2023-7104",
    "CVE-2025-6965",
    "CVE-2025-70873",
    "CVE-2026-11822",
    "CVE-2026-11824",
    "CVE-2026-71282"
  ],
  "cves": null,
  "max_epss": 0.74866,
  "last_updated": "2026-08-16T11:18:08.825063Z",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null,
    "source_published_at": null,
    "observed_at": null,
    "ingested_at": null,
    "first_served_at": null,
    "provenance": null
  },
  "supply_chain_monitored": true,
  "typosquat": null
}

cleaner line

Newer release

bash

curl "https://api.attestd.io/v1/check?product=sqlite&version=3.49.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

CVE	Description	Affects	CVSS
`CVE-2022-35737`	Out-of-bounds read when a crafted query uses a long string.	3.39.x	7.5
`CVE-2021-36690`	Use-after-free in ALTER TABLE paths.	3.36.x	7.3
`CVE-2020-35527`	NULL pointer dereference via crafted SQL.	3.31–3.33	7.5
`CVE-2019-19646`	Authorization bypass when trusted schema is off.	3.30.x	9.8
`CVE-2023-7104`	Memory safety / integer handling (verify NVD).	see NVD	7.3

All products PostgreSQL MySQL