CVE-2026-119376

SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

6.8 Medium

CVE-2026-119376 is a medium vulnerability (CVSS 6.8) in Sqlite, published October 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. No source names a fixed version.

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.16%Unchanged since Oct 31, 2026

What each source reports

CVE List Score used 6.8

SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

Record: CVE-2026-119376
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

EUVDEUVD-2026-113787 6.8

Record: EUVD-2026-113787
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-8chh-5w6j-2xwf 6.8

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass...

Record: GHSA-8chh-5w6j-2xwf
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

NVD 6.8

Record: CVE-2026-119376
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-674
Updated: 2026-11-02

OSV 6.8

SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

Record: CVE-2026-119376
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-674
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-119376 5.5

Record: DEBIAN-CVE-2026-119376
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVAZL-111778 No score

CVE-2026-119376 affecting package sqlite 3.44.0-4

Record: AZL-111778
Updated: 2026-11-02

Affected products

sqlite

Affected packages

Affected packages
Package	Affected	Fixed
`sqlite` Azure Linux:3	through 3.44.0-4	None known
`sqlite3` Debian:12	All versions, plus listed versions 3.40.1-23.40.1-2+deb12u13.40.1-2+deb12u23.42.0-13.43.0-1 Show 25 moreShow less 3.43.1-13.43.2-13.44.0-13.44.2-13.45.0-13.45.1-13.45.2-13.45.3-13.45.3-2~exp13.46.0-13.46.1-13.46.1-23.46.1-2~exp3.46.1-33.46.1-43.46.1-53.46.1-63.46.1-73.46.1-83.46.1-93.53.2-13.53.3-13.53.4-13.53.4-23.54.1-1	None known
`sqlite3` Debian:13	All versions, plus listed versions 3.46.1-73.46.1-7+deb13u13.46.1-7+deb13u23.46.1-83.46.1-9 Show 5 moreShow less 3.53.2-13.53.3-13.53.4-13.53.4-23.54.1-1	None known
`sqlite3` Debian:14	All versions, plus listed versions 3.46.1-73.46.1-83.46.1-93.53.2-13.53.3-13.53.4-13.53.4-23.54.1-1	None known

History

History
When	Changed	Sources
2026-11-03	affected	OSV
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 7 moreShow less