CVE-2025-29088

In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.

Database specific

{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-190"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29088.json"
}

References

Affected packages

Git / github.com/sqlite/sqlite

Affected ranges

Type

GIT

Repo

https://github.com/sqlite/sqlite

Events

Introduced

659bafd05dee789298074283ce857e27e65ef675

Fixed

3cd92ce875fd4e5601e535c35fef33494a6684e3

Fixed

56d2fd008b108109f489339f5fd55212bb50afd4

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.49.0"
                },
                {
                    "fixed":  "3.49.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "56d2fd008b108109f489339f5fd55212bb50afd4"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

3.*

3.49.0

version-3.*

version-3.49.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-29088.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "5429052069220559463260089493636071609",
            "length":  2737
        },
        "id":  "CVE-2025-29088-69bc8e80",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4",
        "target":  {
            "file":  "src/main.c",
            "function":  "setupLookaside"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "39826769564372032825417142920266208978",
                "131744436590503758423334362165627665526",
                "156887614002996371651060072260617843233",
                "22136163177545101843723995456546001038",
                "159263920347785671602192097111218575962",
                "269888135610323103955213216169360149096",
                "100507046096844854820297547028498584049",
                "137860169083551923182255130981399545593",
                "169295985084664084716035143178358945038",
                "224581361444588764553703061731657690862",
                "254961715956719408494865708781294070951",
                "34367095266247901411946366506791138213",
                "85749957422984725276054991603402471436",
                "289160059118046469697642598445374425411",
                "264931618189465631739270240648043167270",
                "153711847611322404467672144729869832259",
                "88819407589660696616667168905306560324",
                "78310239316019648382233471021170002623",
                "309044393595509933975460334536793728981",
                "65788192120267222678882514538643449038",
                "195859394979415466483821601830902246210",
                "100976245618461176497342310742969343975",
                "157649672884947916678494037889427738783",
                "288640495902043871289867985079375707513",
                "321759326460408989197929602329010527698",
                "137397909491990842435116783858523105752",
                "48151367006986126524073095391989941746",
                "222700987374964209519243816746825526612"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-29088-feb7f724",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4",
        "target":  {
            "file":  "src/main.c"
        }
    }
]

vanir_signatures_modified

"2026-10-21T09:07:09Z"