lemon: A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e...
CVE-2026-50812 is fixed in 17 products on 1 platform, first by lemon 3.46.1-9ubuntu0.2, released July 8, 2026. It is not reported as exploited. Patch Radar priority: Routine.
A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| lemon · Ubuntu 22.04.1 LTS (jammy) | 3.37.2-2ubuntu0.7 | lemon 3.37.2-2ubuntu0.7 | Jul 23, 2026 |
| lemon · Ubuntu 24.04.5 LTS (noble) | 3.45.1-1ubuntu2.7 | lemon 3.45.1-1ubuntu2.7 | Jul 23, 2026 |
| lemon · Ubuntu 26.04.1 LTS (resolute) | 3.46.1-9ubuntu0.2 | lemon 3.46.1-9ubuntu0.2 | Jul 8, 2026 |
| libsqlite3-0 · Ubuntu 22.04.1 LTS (jammy) | 3.37.2-2ubuntu0.7 | libsqlite3-0 3.37.2-2ubuntu0.7 | Jul 23, 2026 |
| libsqlite3-0 · Ubuntu 24.04.5 LTS (noble) | 3.45.1-1ubuntu2.7 | libsqlite3-0 3.45.1-1ubuntu2.7 | Jul 23, 2026 |
| libsqlite3-0 · Ubuntu 26.04.1 LTS (resolute) | 3.46.1-9ubuntu0.2 | libsqlite3-0 3.46.1-9ubuntu0.2 | Jul 8, 2026 |
| libsqlite3-ext-csv · Ubuntu 26.04.1 LTS (resolute) | 3.46.1-9ubuntu0.2 | libsqlite3-ext-csv 3.46.1-9ubuntu0.2 | Jul 8, 2026 |
| libsqlite3-ext-icu · Ubuntu 26.04.1 LTS (resolute) | 3.46.1-9ubuntu0.2 | libsqlite3-ext-icu 3.46.1-9ubuntu0.2 | Jul 8, 2026 |
| libsqlite3-tcl · Ubuntu 22.04.1 LTS (jammy) | 3.37.2-2ubuntu0.7 | libsqlite3-tcl 3.37.2-2ubuntu0.7 | Jul 23, 2026 |
| libsqlite3-tcl · Ubuntu 24.04.5 LTS (noble) | 3.45.1-1ubuntu2.7 | libsqlite3-tcl 3.45.1-1ubuntu2.7 | Jul 23, 2026 |
| libsqlite3-tcl · Ubuntu 26.04.1 LTS (resolute) | 3.46.1-9ubuntu0.2 | libsqlite3-tcl 3.46.1-9ubuntu0.2 | Jul 8, 2026 |
| nodejs22 · amzn 2023 | 1:22.23.2-1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
| nodejs22-debuginfo · amzn 2023 | 1:22.23.2-1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
| nodejs22-debugsource · amzn 2023 | 1:22.23.2-1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
| nodejs22-devel · amzn 2023 | 1:22.23.2-1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
| nodejs22-docs · amzn 2023 | 1:22.23.2-1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
| nodejs22-full-i18n · amzn 2023 | 1:22.23.2-1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
| nodejs22-libs · amzn 2023 | 1:22.23.2-1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
| nodejs22-libs-debuginfo · amzn 2023 | 1:22.23.2-1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
| nodejs22-npm · amzn 2023 | 1:10.9.8-1.22.23.2.1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
| sqlite3 · Debian 14 | 3.53.2-1 | DEBIAN-CVE-2026-50812 | Jul 20, 2026 |
| sqlite3 · Ubuntu 22.04.1 LTS (jammy) | 3.37.2-2ubuntu0.7 | sqlite3 3.37.2-2ubuntu0.7 | Jul 23, 2026 |
| sqlite3 · Ubuntu 24.04.5 LTS (noble) | 3.45.1-1ubuntu2.7 | sqlite3 3.45.1-1ubuntu2.7 | Jul 23, 2026 |
| sqlite3 · Ubuntu 26.04.1 LTS (resolute) | 3.46.1-9ubuntu0.2 | sqlite3 3.46.1-9ubuntu0.2 | Jul 8, 2026 |
| sqlite3-tools · Ubuntu 22.04.1 LTS (jammy) | 3.37.2-2ubuntu0.7 | sqlite3-tools 3.37.2-2ubuntu0.7 | Jul 23, 2026 |
| sqlite3-tools · Ubuntu 24.04.5 LTS (noble) | 3.45.1-1ubuntu2.7 | sqlite3-tools 3.45.1-1ubuntu2.7 | Jul 23, 2026 |
| sqlite3-tools · Ubuntu 26.04.1 LTS (resolute) | 3.46.1-9ubuntu0.2 | sqlite3-tools 3.46.1-9ubuntu0.2 | Jul 8, 2026 |
| v8-12.4-devel · amzn 2023 | 3:12.4.254.21-1.22.23.2.1.amzn2023.0.2 | ALAS2023-2026-2060 | Aug 17, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.