Vulnpedia
← All CVEs

CVE-2026-11822

HIGH 8.5 ALL-YEARS

Published 2026-06-09 · Last modified 2026-10-15 · VulnCheck · NVD: Modified

SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.

ELEVATED IMPACT

Severe if exploited (CVSS 8.5), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 30th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

8.5CVSS 4.0 · HIGH · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: Succeeds with passive user activity
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Sqlite Siemens

Products Sqlite Ruggedcom Crossbow Station Access Controller (Sac)

Weakness (CWE)

  • CWE-122: Heap-based Buffer Overflow

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 2021 vendor product statements; 1989 omitted. Read the full vendor advisory.

  • rhcos-x86_64-412.86.202609082051-0 as a component of Red Hat OpenShift Container Platform 4.12 · fixed

    Vendor assessment for this product only.

    pkg:generic/redhat/[email protected]?arch=x86_64

    • vendor fix: For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:0ba3b9ea13531f643027339fef1e1a1e04bd4d87f3387f25e6d7e3dfa64bad52 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • nodejs-full-i18n-1:22.23.1-3.module+el8.10.0+24640+6eba5e6e.ppc64le (nodejs:22) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B24640%2B6eba5e6e?arch=ppc64le&epoch=1&rpmmod=nodejs:22:8100020260807115047:6d880403

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • sqlite-devel-0:3.34.1-6.el9_2.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.3?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • sqlite-tcl-debuginfo-0:3.34.1-8.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6.1?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • v8-13.6-devel-3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee.s390x (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel9.8.0%2B24638%2B75f46aee?arch=s390x&epoch=3&rpmmod=nodejs:24:9080020260806135511:rhel9

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • sqlite-0:3.26.0-13.el8_4.2.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4.2?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • sqlite-tcl-debuginfo-0:3.34.1-6.el9_2.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.3?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9@sha256:78431228c2902c8b51c50d5f487d1789f35ac994e3089e6448234f8b13577233_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.17 · fixed

    Vendor assessment for this product only.

    pkg:oci/cert-manager-istio-csr-rhel9@sha256%3A78431228c2902c8b51c50d5f487d1789f35ac994e3089e6448234f8b13577233?arch=arm64&repository_url=registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9&tag=1791378395

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images are different depending on the installation plan approval policy you used when installing the cert-manager Operator for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional information. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-codeflare-operator-rhel9@sha256:d0c30e9840190e7db0e818ecd75409a774cc6ac0e5f802b7d21537e81a94a2d3_amd64 as a component of Red Hat OpenShift AI 2.25 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-codeflare-operator-rhel9@sha256%3Ad0c30e9840190e7db0e818ecd75409a774cc6ac0e5f802b7d21537e81a94a2d3?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-codeflare-operator-rhel9&tag=1791861503

    • vendor fix: For Red Hat OpenShift AI 2.25.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-dashboard-rhel9@sha256:ed1e9e469333c72d2f5f446ab0c69a2383538172b9dad48ca8d4a44ea1858502_s390x as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/odh-dashboard-rhel9@sha256%3Aed1e9e469333c72d2f5f446ab0c69a2383538172b9dad48ca8d4a44ea1858502?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-dashboard-rhel9&tag=1791861020

    • vendor fix: For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhui5/rhua-rhel9@sha256:ace80f39f33d921b97be5c74257b52d64170e4eac4b0e2db7d7d13a598d38450_amd64 as a component of Red Hat Update Infrastructure 5 · fixed

    Vendor assessment for this product only.

    pkg:oci/rhua-rhel9@sha256%3Aace80f39f33d921b97be5c74257b52d64170e4eac4b0e2db7d7d13a598d38450?arch=amd64&repository_url=registry.redhat.io/rhui5/rhua-rhel9&tag=1788880581

    • vendor fix: The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • exploit-intelligence-tech-preview/agent-client-rhel9 as a component of Exploit Intelligence · known affected

    Vendor assessment for this product only.

    pkg:oci/agent-client-rhel9@sha256:ab0ad38061edd3ea804d315eb9c3fb0623c1812071466a580af06f1535df3a37?arch=x86_64&repository_url=quay.io/exploit-intelligence-tech-preview/agent-client-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • rhaii/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:0c2ac747d67dc0e80162ff05867dd702e474b2217659f19f28b8e3a0c03a942a?arch=x86_64&repository_url=quay.io/rhaii/vllm-tpu-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • rhaiis/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:b1c12112a1e8a298645e10d34d44c9961a6121aa8d87fc5d65ad83e1ffa3c586?arch=x86_64&repository_url=quay.io/rhaiis/vllm-tpu-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • sqlite as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/sqlite

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • sqlite-tcl as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/sqlite-tcl

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?arch=x86_64&repository_url=quay.io/rhelai3/bootc-gaudi-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • rhoai/odh-ai-gateway-payload-processing-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-ai-gateway-payload-processing-rhel9@sha256:145511ba70395e89ad2b6861210d079d54a11159c53df100bcf17c60ccb0477b?arch=x86_64&repository_url=quay.io/rhoai/odh-ai-gateway-payload-processing-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • rhoai/odh-llm-d-kv-cache-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-llm-d-kv-cache-rhel9@sha256:6228831494c200a94876d7d8027ee5eb87939efc1be9cbdb55b71e0390d5bb44?arch=x86_64&repository_url=quay.io/rhoai/odh-llm-d-kv-cache-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • rhoai/odh-ml-pipelines-runtime-generic-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-ml-pipelines-runtime-generic-rhel9@sha256:63e38d012847986e4fecfa845cd041a0545199a270252ddacedf9ae21c130e19?arch=x86_64&repository_url=quay.io/rhoai/odh-ml-pipelines-runtime-generic-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • rhoai/odh-th06-cpu-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-th06-cpu-torch291-py312-rhel9@sha256:f41414d319c2af4a36ff991b4905dd17aaeec2db0ca0af4dd5d76501b28bbb15?arch=x86_64&repository_url=quay.io/rhoai/odh-th06-cpu-torch291-py312-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-vllm-gaudi-rhel9@sha256:a71763bda2e2c3a9827771c5a6116f4372fb827f2c7d2324adcd6d6a5eff9d54?arch=x86_64&repository_url=quay.io/rhoai/odh-vllm-gaudi-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:a5f4c1a5cffdd4a0449fdf9b05815810e92d27601e9d683ed647ee1c2e5df4cf_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3Aa5f4c1a5cffdd4a0449fdf9b05815810e92d27601e9d683ed647ee1c2e5df4cf?arch=ppc64le&repository_url=registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9&tag=1790223630

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9@sha256:2768a96de745eb6803b1fe0663d14e1e5a9cdd10773d14582acb09b183b91189_ppc64le as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ml-pipelines-scheduledworkflow-v2-rhel9@sha256%3A2768a96de745eb6803b1fe0663d14e1e5a9cdd10773d14582acb09b183b91189?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9&tag=1791864441

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:3c5a575ef33b0518a63dba664214c6ef05fcadf6d5c7f56fddab271766bacd12_amd64 as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256%3A3c5a575ef33b0518a63dba664214c6ef05fcadf6d5c7f56fddab271766bacd12?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9&tag=1791869442

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-kube-auth-proxy-rhel9@sha256:d9b77d0655ee812a598d034c2a36af672de5ed848861a305fbaffd59720495c9_amd64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kube-auth-proxy-rhel9@sha256%3Ad9b77d0655ee812a598d034c2a36af672de5ed848861a305fbaffd59720495c9?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-kube-auth-proxy-rhel9&tag=1790131476

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-model-registry-rhel9@sha256:32fb43be680037658148711ab936de37e56abf5e191cd4f68e8de881bc220ca2_amd64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-model-registry-rhel9@sha256%3A32fb43be680037658148711ab936de37e56abf5e191cd4f68e8de881bc220ca2?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-model-registry-rhel9&tag=1790136118

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-trustyai-service-rhel9@sha256:b53ceb104c844b1363ae53afb6b8f1d7ec1418d14620c872c63dc9c2ab35a7d6_s390x as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-trustyai-service-rhel9@sha256%3Ab53ceb104c844b1363ae53afb6b8f1d7ec1418d14620c872c63dc9c2ab35a7d6?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-trustyai-service-rhel9&tag=1790677424

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-kserve-agent-rhel9@sha256:636ba382740d2c14ace1c03d8474e460dc78929237e1efae7bd2da58605fb9f8_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kserve-agent-rhel9@sha256%3A636ba382740d2c14ace1c03d8474e460dc78929237e1efae7bd2da58605fb9f8?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-kserve-agent-rhel9&tag=1791468381

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-mod-arch-gen-ai-rhel9@sha256:b12d8247d21c8c862e5f4824145e4a6ac90ab73ce149d5ef7b1eb1d1f34b9def_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-gen-ai-rhel9@sha256%3Ab12d8247d21c8c862e5f4824145e4a6ac90ab73ce149d5ef7b1eb1d1f34b9def?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-mod-arch-gen-ai-rhel9&tag=1791861479

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • registry.redhat.io/rhoai/odh-vllm-cpu-rhel9@sha256:4cfc3aafe49188fcafbe77e94a542979b2a16914224f90139ace992ae241f7be_s390x as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-vllm-cpu-rhel9@sha256%3A4cfc3aafe49188fcafbe77e94a542979b2a16914224f90139ace992ae241f7be?arch=s390x&repository_url=registry.redhat.io/rhoai/odh-vllm-cpu-rhel9&tag=1792018438

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00
  • rhoai/odh-notebook-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:oci/odh-notebook-controller-rhel9@sha256:36179d1da580b7e646d52d445a2b893836a2420adb64fbbad27d4d59ff64c903?arch=x86_64&repository_url=quay.io/rhoai/odh-notebook-controller-rhel9

    Red Hat · CVE-2026-11822 · Updated 2026-10-22T19:03:46+00:00

Known Affected Software Configurations

VendorProductVersion range
SqliteSqlite< 3.53.2

All CVSS metrics

  • HIGH 7.8 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • HIGH 8.5 v4.0 · CNA Primary
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • HIGH 8.5 v4.0 · NVD Secondary
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS