Live › vulnerability › CVE-2026-119376
SQLite before 3.54.0 fails to enforce its expression depth limit when COLLATE postfix operators are chained. An attacker who can supply about 175,000 chained COLLATE operators in SQL or an untrusted database view can exhaust the stack and crash the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that accept SQL text or open database files from untrusted sources and pass them to SQLite are exposed to a process crash. Applications that only run trusted, locally authored SQL are unlikely to be affected. unknown whether other conditions apply.
No product ranges from the sources yet.
sqlite3 --version or check the bundled SQLite version in your application dependencies3.54.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
This page as .md · .json · in your agent: get_signal("CVE-2026-119376")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.