{"id":"RUSTSEC-2022-0090","revision":"f84602872e724c329fe9fafdf130db0d","records":[{"revision":"f84602872e724c329fe9fafdf130db0d","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2022-0090","aliases":["BIT-sqlite-2022-35737","CVE-2022-35737","GHSA-jw36-hf63-69r9"],"title":"`libsqlite3-sys` via C SQLite CVE-2022-35737","description":"It was sometimes possible for SQLite versions >= 1.0.12, < 3.39.2 to allow an array-bounds overflow when large string were input into SQLite's `printf` function.\n\nAs `libsqlite3-sys` bundles SQLite, it is susceptible to the vulnerability. `libsqlite3-sys` was updated to bundle the patched version of SQLite [here](https://github.com/rusqlite/rusqlite/releases/tag/sys0.25.1).","state":0,"publishedAt":"2022-08-03T12:00:00+00:00","modifiedAt":"2023-12-06T01:02:25.135287+00:00","affected":[{"ecosystem":"crates.io","name":"libsqlite3-sys","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.25.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/libsqlite3-sys","https://rustsec.org/advisories/RUSTSEC-2022-0090.html","https://nvd.nist.gov/vuln/detail/CVE-2022-35737"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2022-0090","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2022-0090","identifiers":["RUSTSEC-2022-0090","BIT-sqlite-2022-35737","CVE-2022-35737","GHSA-jw36-hf63-69r9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}