CVE-2019-16168
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a…
Published Sep 9, 2019 · updated Oct 14, 2026 · sqlite sqlite
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 9, 2019 · NIST NVD
Detected
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Oct 14, 2026 · NIST NVD
Updated
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
Affected
- cpe canonical/ubuntu linux12.04
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora30
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/e-series santricity os controllerversion unspecified
- cpe netapp/oncommand insightversion unspecified
- cpe netapp/oncommand workflow automationversion unspecified
- cpe netapp/ontap select deploy administration utilityversion unspecified
- cpe netapp/santricity unified managerversion unspecified
- cpe sqlite/sqliteversion unspecified
- cpe tenable/nessus agentversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2019-16168
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2019-16168
30-day exploitation probability 4.3%
first.org - NIST NVDVulnerability recordCVE-2019-16168
In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the query planner."
nvd.nist.gov