CVE-2026-119376: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

Published Oct 30, 2026

Updated

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

Other sources

SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

— Microsoft

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SQLite to a version that resolves this vulnerability.
Fixed in 3.54.0

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Oct 31, 2026

Data Sourced

via Microsoft·08:05 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using SQLite versions before 3.54.0 are exposed when they process attacker-controlled SQL or open an untrusted database containing a view with a very long chain of COLLATE postfix operators.

What does an attacker need to trigger the crash?

The attacker needs a way to provide SQL text or an untrusted database view to the application. Exploitation requires user interaction according to the supplied vector, and the crafted input uses roughly 175,000 chained COLLATE operators.

Does the expression-depth limit protect affected installations?

No. The issue specifically bypasses SQLITE_LIMIT_EXPR_DEPTH through chained COLLATE postfix operators, leading to unbounded recursion in sqlite3WalkExprNN().

What is the impact if exploitation succeeds?

The affected process can crash due to stack exhaustion. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

CVE-2026-119376: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

Other sources

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the crash?

Does the expression-depth limit protect affected installations?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the crash?

Does the expression-depth limit protect affected installations?

What is the impact if exploitation succeeds?