SQLite third-party support
SQLite 3
SQLite 3
Third-party support for the SQLite 3: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance — independent of the vendor contract.
Issue Management
24/7 engineers own your SQLite 3 incidents end to end.
Vulnerability Remediation
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Compliance Maintenance
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- sqlite
- release
- 3
- product Label
- SQLite
- release Label
- 3
- codename
- lts
- latest Version
- 3.54.1
- release Date
- 2004-09-18
- maintained
- true
- source Url
- https://endoflife.date/sqlite
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for SQLite 3 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for SQLite 3?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for SQLite 3 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
SQLite 3 Support: Frequently Asked Questions
Is the SQLite 3 still supported?
Yes. The SQLite 3 is currently supported by SQLite, and third-party support is available as an alternative — issue management, vulnerability remediation, and compliance help independent of the vendor contract.
How much does third-party support for the SQLite 3 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location. You get an indicative price within 24 hours and a firm quote within 48.
Known Vulnerabilities Affecting SQLite 3
64 published CVEs affect the SQLite 3, including 41 rated critical or high severity. Our 24/7 engineers help you assess exposure, prioritize fixes and apply available patches.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-35527 | CRITICAL | 9.8 | Sep 1, 2022 | In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause. |
| CVE-2020-11656 | CRITICAL | 9.8 | Apr 9, 2020 | In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement. |
| CVE-2019-19646 | CRITICAL | 9.8 | Dec 9, 2019 | pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns. |
| CVE-2019-19317 | CRITICAL | 9.8 | Dec 5, 2019 | lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact. |
| CVE-2017-10989 | CRITICAL | 9.8 | Jul 7, 2017 | The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact. |
| CVE-2015-5895 | HIGH | 10.0 | Sep 18, 2015 | Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors. |
| CVE-2026-119586 | HIGH | 8.5 | Oct 30, 2026 | SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3. |
| CVE-2026-119379 | HIGH | 8.5 | Oct 30, 2026 | SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation. |
| CVE-2026-119374 | HIGH | 8.5 | Oct 30, 2026 | SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application. |
| CVE-2026-119373 | HIGH | 8.5 | Oct 30, 2026 | SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process. |
| CVE-2026-11824 | HIGH | 8.5 | Jun 9, 2026 | SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in |
| CVE-2019-5018 | HIGH | 8.1 | May 10, 2019 | An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability. |
| CVE-2018-20506 | HIGH | 8.1 | Apr 3, 2019 | SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346. |
| CVE-2018-20346 | HIGH | 8.1 | Dec 21, 2018 | SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan. |
| CVE-2025-70873 | HIGH | 7.5 | Mar 12, 2026 | An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file. |
| CVE-2021-31239 | HIGH | 7.5 | May 9, 2023 | An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function. |
| CVE-2020-35525 | HIGH | 7.5 | Sep 1, 2022 | In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing. |
| CVE-2022-35737 | HIGH | 7.5 | Aug 3, 2022 | SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. |
| CVE-2021-36690 | HIGH | 7.5 | Aug 24, 2021 | A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library. |
| CVE-2020-13871 | HIGH | 7.5 | Jun 6, 2020 | SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. |
Showing the 20 most severe of 64 known CVEs.
Get Third Party SupportRelated SQLite Products
All SQLite products →SQLite 3
Price in 24 hours · 40-70% below OEM