New to Telerik Reporting? Start a free 30-day trial

SQLitePCLRaw.lib.e_sqlite3 Has a Vulnerable Dependency on SQLite (CVE-2025-6965)

Updated on Aug 28, 2026

Environment

Product	Progress® Telerik® Reporting
Version	20.1.26.615 and earlier

After running a dependency audit or reviewing GitHub Dependabot alerts, the project reports a high-severity vulnerability (CVE-2025-6965) in SQLitePCLRaw.lib.e_sqlite3 version 2.1.11 or earlier. The vulnerability originates in SQLite versions before 3.50.2.

The dependency chain in a Telerik Reporting project looks like this:

[net10.0]
├── Telerik.Reporting (v20.1.26.615)
│   └── SQLitePCLRaw.bundle_green (v2.1.11)
│       └── SQLitePCLRaw.lib.e_sqlite3 (v2.1.11)

Run a dependency audit

NuGet Audit runs during package restore and reports package vulnerabilities with NU1901 through NU1904 warnings.

Visual Studio

In Solution Explorer, right-click the solution and select Restore NuGet Packages.
Open View > Error List and search for NU1901, NU1902, NU1903, or NU1904.
Inspect the warning details to identify the affected package and project. Check the transitive dependency chain when the warning refers to SQLitePCLRaw.lib.e_sqlite3.

.NET CLI with `PackageReference`

For an SDK-style project that uses PackageReference, run the following command from a Developer PowerShell or command prompt:

powershell

dotnet list path\to\Project.csproj package --vulnerable --include-transitive

Replace path\to\Project.csproj with the path to the project you want to audit. The command reports vulnerable direct and transitive packages found for the project.

Legacy `packages.config` projects

For a .NET Framework project that uses packages.config, restore the solution in Visual Studio and review the NU1901 through NU1904 warnings in the Error List. The .NET CLI package-list command above is intended for projects using PackageReference.

For additional NuGet Audit commands, configuration options, and supported NuGet versions, see Audit packages for security vulnerabilities.

For additional context, Telerik Reporting uses SQLite as a persistent disk cache for the Map report item. When a report containing a Map is rendered, the reporting engine downloads map tile images and geocoding results from external web services, and SQLite stores those results on disk so that subsequent renders can skip the web requests.

Cause

The SQLitePCLRaw.bundle_green package (version 2.1.11) bundles a native SQLite library at version 3.49.1, which is affected by CVE-2025-6965. At the time of writing, there is no patched version of SQLitePCLRaw.lib.e_sqlite3 available from the package maintainers.

Solution

The official solution is to update Telerik Reporting to 20.1.26.707 or later. The 20.1.26.707 release notes state that the internal cache uses SQLite 3.50.4 for .NET Framework and .NET 8+ projects.

Workaround

In the meantime, the vulnerability can be mitigated by installing the SourceGear.sqlite3 package, version 3.50.4.5, which supplies a newer native SQLite binary (3.50.4) that replaces the vulnerable one at runtime.

Add the following package reference to your project file:

xml

<PackageReference Include="SourceGear.sqlite3" Version="3.50.4.5" />

This bumps the native SQLite version to 3.50.4, which resolves the underlying memory corruption issue. The SQLitePCLRaw.lib.e_sqlite3 package reference will still appear in the dependency graph, but the actual native binary used at runtime will be the patched version supplied by SourceGear.sqlite3.

After adding the package, rebuild and render a report, then check the application logs. During report rendering, Telerik Reporting logs the loaded SQLite native version. Use the following as an example of the expected trace:
text
SampleApp Information: 0 : *** ReportProcessor.ProcessReport STARTED ***
SampleApp Information: 0 : SQLite x64: v3050004
The key line is SQLite x64: v3050004, which corresponds to SQLite 3.50.4.

External References

GHSA-2m69-gcr7-jv3q (GitHub Advisory)