DU
Vendor
duckdb
5
CVEs
1
On KEV
1
New 30D
Products
DU9.8
duckdb
duckdb
3 CVEs1 on KEV1 new
DU6.5
duckdb-aws
duckdb
1 CVEs0 on KEV0 new
DU8.6
duckdb-node
duckdb
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111497 In wildKEVNew | DU Duckdb Duckdb | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2026-58139 | DU duckdb-aws duckdb | 6.5 | Aug 3 | DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure |
| CVE-2025-64429 | DU duckdb duckdb | 6.5 | Nov 12 | DuckDB Encryption Crypto implementation is vulnerable |
| CVE-2025-59037 | DU duckdb-node duckdb | 8.6 | Sep 9 | DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware |
| CVE-2024-41672 | DU duckdb duckdb | 7.5 | Jul 24 | DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled |