Visit NES for SQLite JDBC Home Page
SQLite JDBC Release Notes
Comprehensive release notes and changelog for SQLite JDBC, including security patches, bug fixes, and feature updates across all supported versions.
1 Patched Vulnerability
VEX Statements
SQLite JDBC
3.36.2 (NES) - September 9, 2026
Security Fixes
- CVE-2023-32697 (Critical) - Remote code execution when the JDBC URL is attacker controlled. A
jdbc:sqlite::resource:URL downloads the remote resource to a temporary file whose name was derived from the URL's hash, making the path predictable, and an existing file at that path was reused whenever its modification time was newer than the resource. An attacker able to predict or influence the JDBC URL could place a database at that path and have it loaded in place of the genuine resource. Extracted resources are now named with a random UUID. Fixed upstream in 3.41.2.2.
Notes
- Because each extracted resource now has a unique name, a
jdbc:sqlite::resource:connection downloads the resource rather than reusing a previously extracted copy. Applications that open such connections repeatedly will see additional fetches of the remote resource. Connections to ordinary file and in-memory databases are unaffected.
Full Version: 3.36.0-sqlite-jdbc-3.36.2
3.36.1 (NES) - September 8, 2026
Notes
- This release originates from the open-source SQLite JDBC project forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.
- This is the initial supported baseline for the 3.36.x line. It is functionally identical to upstream 3.36.0.3, with no behavioral changes, and contains no vulnerability patches. Security fixes are delivered in subsequent releases on this line.
- Upstream ended maintenance of the 3.36 line at 3.36.0.3.
Full Version: 3.36.0-sqlite-jdbc-3.36.1