Is DuckDB 2.0.0 patched?
Summary iPlain-English security status for DuckDB 2.0.0, built from its CVEs, active-exploitation data, end-of-life date and latest release.
DuckDB 2.0.0 is part of the 2.0 release line. 1 actively-exploited vulnerability affects it (CISA KEV). The 2.0 line is supported until 2027-10-21. The latest supported DuckDB release is 2.0.0.
Known issues affecting 2.0.0
Exploited first, then by exploitation probability.
CVE-2026-111497 CRITICAL exploited EPSS 83% → see advisoryOther DuckDB versions
Check another release line of DuckDB.
Frequently asked
Is DuckDB 2.0.0 patched?
No — 1 actively-exploited vulnerability affects DuckDB 2.0.0. Upgrade now.
When does DuckDB 2.0 reach end-of-life?
DuckDB 2.0 is supported until 2027-10-21.
What is the latest version of DuckDB?
The latest supported DuckDB release is 2.0.0.
Is DuckDB 2.0.0 still receiving security updates?
Yes — the 2.0 line is still supported until 2027-10-21 and receiving security updates.
Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against DuckDB's official advisory before you patch or upgrade — DuckDB official site ↗