Read the docs
TI-2026-37437 Aliases CVE-2026-50813GHSA-pp2q-fpvv-vr5h

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain…

Priority LOW 26CWE-126Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00159 5th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

Remediation

Red Hat 1 advisory

  • RHSA-2026:23423 Released 2026-06-04 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images lemon-3.53.2-1.hum1@aarch64, lemon-3.53.2-1.hum1@x86_64, sqlite-3.53.2-1.hum1@aarch64 +16

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:23423

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50813
  2. 2026-10-03 Alias added: GHSA-pp2q-fpvv-vr5h

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences