CVE-2026-119376: sqlite sqlite

CVSS 6.8 (medium) · published 2026-10-30

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

Affected products (NVD): sqlite sqlite

Fixed in (NVD): 3.54.0

Weakness: CWE-674

Source: NVD CVE-2026-119376

References

• https://abraxaslabs.tech/research/sqlite-collate-depth
• https://github.com/sqlite/sqlite
• https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175
• https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2
• https://sqlite.org/bugs/info/2026-10-04T04:50:56Z
• https://sqlite.org/releaselog/3_54_0.html
• https://sqlite.org/src/info/252c0b7bf5a727d2
• https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain
• https://sqlite.org/bugs/info/2026-10-04T04:50:56Z

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.