CVE-2019-19924
SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3Windo
CVSS
5.3
Medium
EPSS
10.7%
p96
KEV
—
Exploit Today
29
0-100
Published: Dec 24, 2019 · Last modified: Oct 14, 2026 · CWE-755
7.9%EPSS · 30 days10.7%
2026-09-282026-10-26
SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- github.comhttps://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3
- lists.apache.orghttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20200114-0003/
- usn.ubuntu.comhttps://usn.ubuntu.com/4298-1/
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.html
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- github.comhttps://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3
- lists.apache.orghttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20200114-0003/
- usn.ubuntu.comhttps://usn.ubuntu.com/4298-1/
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.html
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-389290.html
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-727587.5 HIG—
——0When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the range, Routinator will never reach the maximum value and run out of memory.1dCVE-2026-727575.3 MED—
——0Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving the HTTP server unavailable. This condition can be triggered maliciously by an attacker by opening a large number of connections to the HTTP server.
This only affects users that make their HTTP or RTR server available to untrusted networks.1dCVE-2026-727567.5 HIG—
——0Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names, and folder names that overlap with existing file names.1dCVE-2026-727553.8 LOW—
——0Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.1dCVE-2026-727547.5 HIG—
——0When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong encoding, it may exit.1dCVE-2026-727538.2 HIG—
——0When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to missing data. If it encounters too many delta entries it may run out of memory.1d