Stack Exhaustion Vulnerability in SQLite Before Version 3.54.0
CVE-2026-119376

6.8MEDIUM

Key Information:

Vendor

Sqlite

Status
Sqlite
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119376?

SQLite versions prior to 3.54.0 are susceptible to a stack exhaustion issue that occurs when attackers exploit an excess of COLLATE postfix operators. By supplying around 175,000 chained COLLATE operations in SQL statements or through untrusted database views, an attacker can trigger unbounded recursion within the sqlite3WalkExprNN() function, ultimately leading to a crash of the SQLite process. This vulnerability presents a significant risk to applications relying on SQLite for database management, as it can disrupt service and compromise system stability.

Affected Version(s)

SQLite 0 < 3.54.0

References

https://sqlite.org/bugs/info/2026-10-04T04:50:56Z
issue-tracking
https://sqlite.org/src/info/252c0b7bf5a727d2
patch
https://github.com/sqlite/sqlite/commit/d54522a5b832422ab...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ke Han
Abraxas Labs
D. Richard Hipp
.