AZL-111778: CVE-2026-119376 affecting package sqlite 3.44.0-4

Q: What inputs would need to be attacker-controlled for this issue to be exploitable?

An attacker needs to be able to supply SQL containing approximately 175,000 chained COLLATE postfix operators, or provide an untrusted database containing a view with that expression structure. The resulting expression processing can cause unbounded recursion in sqlite3WalkExprNN().

Q: What is the practical impact of successful exploitation?

Successful exploitation can exhaust the process stack and crash the SQLite-using process. The provided information describes a denial-of-service condition rather than data disclosure or code execution.

Q: Are deployments using SQLite 3.44.0-4 affected?

Yes. The affected package is identified as sqlite 3.44.0-4, and the issue affects SQLite versions before 3.54.0.

Published Oct 30, 2026

Updated

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

Affected Software

1 affected component

azure-linux/sqlite<=3.44.0-4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade sqlite to a version that resolves this vulnerability.
Fixed in 3.54.0

Event History

Oct 30, 2026

Advisory Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-119376

Frequently Asked Questions

What inputs would need to be attacker-controlled for this issue to be exploitable?

An attacker needs to be able to supply SQL containing approximately 175,000 chained COLLATE postfix operators, or provide an untrusted database containing a view with that expression structure. The resulting expression processing can cause unbounded recursion in sqlite3WalkExprNN().

What is the practical impact of successful exploitation?

Successful exploitation can exhaust the process stack and crash the SQLite-using process. The provided information describes a denial-of-service condition rather than data disclosure or code execution.

Are deployments using SQLite 3.44.0-4 affected?

Yes. The affected package is identified as sqlite 3.44.0-4, and the issue affects SQLite versions before 3.54.0.

AZL-111778: CVE-2026-119376 affecting package sqlite 3.44.0-4

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What inputs would need to be attacker-controlled for this issue to be exploitable?

What is the practical impact of successful exploitation?

Are deployments using SQLite 3.44.0-4 affected?

Company

Resources

Contact

Frequently Asked Questions

What inputs would need to be attacker-controlled for this issue to be exploitable?

What is the practical impact of successful exploitation?

Are deployments using SQLite 3.44.0-4 affected?