UBUNTU-CVE-2026-119376: SQL Injection
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SQLiteto a version that resolves this vulnerability.Fixed in 3.54.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications are exposed when they execute attacker-supplied SQL or open database files containing untrusted views. The CVSS vector indicates local attack access, no privileges required, and user interaction required.
What input is needed to trigger the issue?
An attacker needs to provide SQL containing roughly 175,000 chained COLLATE postfix operators, or an untrusted database view containing that construction. The resulting recursion in sqlite3WalkExprNN() can crash the affected process.