What’s Vulnerable › Vulnerabilities
CVE-2022-35737
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 23.6% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-08-03 · updated 2026-10-14
- Weakness: CWE-129
Description
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
Affected products
- NetApp ONTAP Select Deploy administration utility: all versions
- Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6
- SQLite: from 1.0.12 before 3.39.2 — fixed in 3.39.2
How to fix
Upgrade to a fixed version: Splunk Universal Forwarder 8.2.12, 9.0.6; SQLite 3.39.2. Check the vendor advisory for mitigations.
References
- https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
- https://kb.cert.org/vuls/id/720344
- https://security.gentoo.org/glsa/202210-40
- https://security.netapp.com/advisory/ntap-20220915-0009/
- https://sqlite.org/releaselog/3_39_2.html
- https://www.sqlite.org/cves.html
- https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
- https://kb.cert.org/vuls/id/720344
- https://security.gentoo.org/glsa/202210-40
- https://security.netapp.com/advisory/ntap-20220915-0009/
- https://sqlite.org/releaselog/3_39_2.html
- https://www.sqlite.org/cves.html
Get alerted when CVE-2022-35737 or the next vulnerability affects your stack