Memory Overflow Vulnerability in SQLite Package: CVE-2025-29087
Summary
ALPINE-CVE-2025-29087: In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. Affects sqlite versions < 3.44.2-r1. Fixed in 3.44.2-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLite is a widely-used, lightweight, serverless SQL database engine that is embedded in applications. It is known for its simplicity and efficiency, making it a popular choice for mobile and desktop applications. However, certain versions of SQLite have been found to be vulnerable to a memory overflow issue that can be exploited through the concat_ws() SQL function.
Vulnerability Detail
The vulnerability identified as CVE-2025-29087 affects SQLite versions 3.44.0 through 3.49.0 before 3.49.1. It arises from the concat_ws() SQL function, which can lead to memory being written beyond the end of a malloc-allocated buffer. If an attacker controls the separator argument and provides a large string (e.g., 2MB or more), it triggers an integer overflow when calculating the size of the result buffer. This can result in insufficient memory allocation, leading to potential application crashes or arbitrary code execution.
How To Fix
Minimum fixed version
3.44.2-r1
This is the first release that contains the fix.
sudo apk add --upgrade sqliteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the concat_ws() function with user-controlled input until the package is updated. Ensure that any separator arguments are sanitized and limited in size to prevent exploitation.
Conclusion
CVE-2025-29087 is a critical vulnerability in the SQLite package that can lead to serious security issues if not addressed. Users are advised to update to the latest patched versions of SQLite to mitigate risks. Regular monitoring of vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for sqlite →
FAQ
CVE-2025-29087 is a vulnerability in SQLite that allows for memory overflow due to improper handling of the concat_ws() function.
SQLite versions 3.44.0 through 3.49.0 before 3.49.1 are affected by this vulnerability.
Exploitation of this vulnerability can lead to application crashes or arbitrary code execution, posing a significant security risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2025-29087 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
