Tailscale traces months of database corruption to a 16-year-old SQLite bug

Tailscale traced roughly six months of silent database corruption on its control-plane infrastructure to a 16-year-old race condition in SQLite, the company said in a post-mortem. The flaw, present since SQLite 3.7.0 shipped in 2010, can silently drop pages during a write-ahead-log (WAL) checkpoint and permanently corrupt a database when WAL mode is active with multiple open connections.

Tailscale, which sells a mesh VPN built on the WireGuard protocol, said it hit 19 separate corruption incidents before working with SQLite’s core developers to find the cause. A first fix was rolled back after it broke something else; the confirmed fix shipped in SQLite 3.51.3.

The bug matters because SQLite is one of the most widely deployed databases in the world, embedded in phones, browsers, and countless server applications. A corruption path that survived undetected for 16 years, triggered only under a specific concurrency pattern, is the kind of fault that hides in production for years before anyone connects the symptoms.

Antithesis, a database-reliability firm, published its own analysis saying its platform could have caught the same bug in about an hour using causality analysis and time-travel debugging. Tailscale’s own hunt, by contrast, required writing a new transaction-logging pipeline and a debugging shim for SQLite’s virtual filesystem layer to pinpoint the fault.

The corruption is not universal: it requires WAL mode with multiple concurrent connections, the default in many but not all deployments. Operators running SQLite under those conditions are the ones who should move to 3.51.3.