EUVD-2026-51253
GHSA-5vr6-8x5x-h94q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Non-default shared-cache mode plus a lock-traversal race raises AC to H; no auth needed so PR:N; memory disclosure gives C:H and crash gives A:H with no integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
SQLite 3.41 has a use-after-free vulnerability in the shared cache lock management logic of the btree module. The program frees a BtLock structure without removing the node from the linked list. Subsequent linked list traversal accesses the released memory, which can lead to denial of service and sensitive memory information disclosure.
AnalysisAI
Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.
Technical ContextAI
SQLite is an embedded, in-process relational database engine linked directly into host applications rather than run as a network service. The defect is classed as CWE-416 (Use After Free) and lives in the btree layer's shared-cache locking code (src/btree.c), which coordinates read/write locks across multiple database connections that share a single page cache within one process. Each lock is tracked by a BtLock node in a per-shared-cache linked list; the bug frees a BtLock node without first removing it from that list, so a later traversal dereferences a dangling pointer into reclaimed heap memory, allowing either a crash or exposure of whatever heap contents now occupy the freed region. Shared-cache mode is an opt-in feature (enabled via sqlite3_enable_shared_cache() or the cache=shared URI/open flag) and is not active in SQLite's default configuration.
RemediationAI
No vendor-released patched version is identified in the provided data, and the only code reference points to the upstream btree.c source rather than a tagged fix, so treat the fixed release as not independently confirmed and monitor https://nvd.nist.gov/vuln/detail/CVE-2026-51290 and sqlite.org for an official release before pinning a version. As the most effective compensating control, disable shared-cache mode where feasible - stop calling sqlite3_enable_shared_cache() and remove cache=shared from connection URIs/open flags - which removes the vulnerable code path entirely; the trade-off is higher per-connection memory use and loss of the cross-connection cache sharing that shared-cache mode provides, which some memory-constrained or high-connection embedded deployments rely on. Where the application controls query input, restrict database access to trusted callers and avoid exposing SQLite queries to untrusted network clients. Once an upstream fix lands in btree.c, rebuild and redistribute all applications that statically link SQLite, since patching a single system library will not update embedded copies.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today