Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119376SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
Medium 5.5
In plain English
A medium-severity security flaw in SQLite from SQLite. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 92.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sqlite3 | no fix listed | DEBIAN-CVE-2026-119376 |
| Debian:13 | sqlite3 | no fix listed | DEBIAN-CVE-2026-119376 |
| Debian:14 | sqlite3 | no fix listed | DEBIAN-CVE-2026-119376 |
| Ubuntu:22.04:LTS | sqlite | no fix listed | UBUNTU-CVE-2026-119376 |
| Ubuntu:22.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2026-119376 |
| Ubuntu:24.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2026-119376 |
| Ubuntu:26.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2026-119376 |
| Ubuntu:26.10 | sqlite3 | no fix listed | UBUNTU-CVE-2026-119376 |
Affected products (as reported)
Weakness: CWE-674 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://sqlite.org/bugs/info/2026-10-04T04:50:56Z issue-tracking
- https://sqlite.org/src/info/252c0b7bf5a727d2 patch
- https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 patch
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175 technical-description
- https://sqlite.org/releaselog/3_54_0.html release-notes
- https://abraxaslabs.tech/research/sqlite-collate-depth third-party-advisory
- https://github.com/sqlite/sqlite product
- VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain third-party-advisory