DEBIAN-CVE-2026-119376: SQL Injection
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.54.0
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications that execute attacker-controlled SQL or open untrusted SQLite databases containing views are exposed. The supplied severity vector indicates local access and user interaction are required.
What does exploitation require?
An attacker needs to supply SQL, or an untrusted database view, containing approximately 175,000 chained COLLATE postfix operators. The severity vector indicates no privileges are required.
What is the expected security impact?
Successful exploitation can crash the SQLite-using process through stack exhaustion. The supplied severity vector indicates an availability impact, with no confidentiality or integrity impact.