CVE-2026-119376SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

Beschreibung

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://sqlite.org/bugs/info/2026-10-04T04:50:56Z issue-trackingIssue Tracking
• https://sqlite.org/src/info/252c0b7bf5a727d2 patchIssue Tracking
• https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 patchPatch
• https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175 technical-descriptionPatch
• https://sqlite.org/releaselog/3_54_0.html release-notesRelease Notes
• https://abraxaslabs.tech/research/sqlite-collate-depth third-party-advisoryExploitThird Party Advisory
• https://github.com/sqlite/sqlite productProduct
• VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain third-party-advisoryThird Party Advisory