CVE-2026-119376 | BDVDB-2026-398477 Detail
SQLiteSQLite
Description#
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact high. Attack vector: local.
Weaknesses#
- CWE-674 Uncontrolled Recursion
References#
- https://sqlite.org/bugs/info/2026-10-04T04:50:56Z
- https://sqlite.org/src/info/252c0b7bf5a727d2
- https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175
- https://sqlite.org/releaselog/3_54_0.html
- https://abraxaslabs.tech/research/sqlite-collate-depth
- https://github.com/sqlite/sqlite
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.