duckdb Schwachstellen (CVE)

Für duckdb veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.

4 Ergebnisse

9.2Kritisch

CVE-2026-111497 KEV vor 16 Tagen

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Cloud Connector Configurator; Siemens Common Configurator (CC on IEM); Siemens Common Configurator on Device (CC on Edge)

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS

6.5Mittel

CVE-2026-58139 vor 3 Monaten

DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure

duckdb duckdb-aws

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter…

6.9Mittel

CVE-2025-64429 vor 12 Monaten

DuckDB Encryption Crypto implementation is vulnerable

duckdb duckdb

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (p…

8.6Hoch

CVE-2025-59037 vor 1 Jahr

DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

duckdb duckdb-node

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packag…