CVE-2026-119376 SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
MediumCVSS 6.8
EPSS 0.18%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SQLite | < 3.54.0 | 3.54.0 |
| azure linux sqlite(Azure Linux:3.0) | All versions | No fix listed |
| redhat/sqlite(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/sqlite(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/sqlite(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/mingw-sqlite(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/nodejs:22/nodejs(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/nodejs:24/nodejs(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/rust-toolset:rhel8/rust(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/sqlite(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/nodejs:22/nodejs(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/nodejs:24/nodejs(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/nodejs:26/nodejs(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/rust(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/sqlite(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/rust(Red Hat:enterprise_linux_ai:3) | All versions | No fix listed |
| redhat/sqlite(Red Hat:hummingbird:1) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-8(Red Hat:openshift:4) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:4) | All versions | No fix listed |
| redhat/openshift/ose-rhel-coreos-9(Red Hat:openshift:5) | All versions | No fix listed |
| ubuntu/sqlite(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/sqlite3(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/sqlite3(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/sqlite3(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/sqlite3(Ubuntu:26.10) | All versions | No fix listed |
Show 52 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sqlite3(Debian:12) | All versions | No fix listed |
| debian/sqlite3(Debian:12) | = 3.40.1-2 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.40.1-2+deb12u1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.40.1-2+deb12u2 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.42.0-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.43.0-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.43.1-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.43.2-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.44.0-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.44.2-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.45.0-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.45.1-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.45.2-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.45.3-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.45.3-2~exp1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.0-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-2 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-2~exp | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-3 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-4 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-5 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-6 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-7 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-8 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.46.1-9 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.53.2-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.53.3-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.53.4-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.53.4-2 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.54.1-1 | No fix listed |
| debian/sqlite3(Debian:12) | = 3.54.1-2 | No fix listed |
| debian/sqlite3(Debian:13) | All versions | No fix listed |
| debian/sqlite3(Debian:13) | = 3.46.1-7 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.46.1-7+deb13u1 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.46.1-7+deb13u2 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.46.1-8 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.46.1-9 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.53.2-1 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.53.3-1 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.53.4-1 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.53.4-2 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.54.1-1 | No fix listed |
| debian/sqlite3(Debian:13) | = 3.54.1-2 | No fix listed |
| debian/sqlite3(Debian:14) | < 3.54.1-1 | 3.54.1-1 |
| debian/sqlite3(Debian:14) | = 3.46.1-7 | No fix listed |
| debian/sqlite3(Debian:14) | = 3.46.1-8 | No fix listed |
| debian/sqlite3(Debian:14) | = 3.46.1-9 | No fix listed |
| debian/sqlite3(Debian:14) | = 3.53.2-1 | No fix listed |
| debian/sqlite3(Debian:14) | = 3.53.3-1 | No fix listed |
| debian/sqlite3(Debian:14) | = 3.53.4-1 | No fix listed |
| debian/sqlite3(Debian:14) | = 3.53.4-2 | No fix listed |
References
- sqlite.org exploit issue-tracking
- sqlite.org issue-tracking patch
- github.com patch
- github.com patch technical-description
- sqlite.org release-notes
- abraxaslabs.tech exploit third-party-advisory
- github.com product
- VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain third-party-advisory
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2563943 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-119376 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- bugs.debian.org issue-tracking