CVE-2026-119376EUVD-2026-113787GHSA-8CHH-5W6J-2XWF
SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.54.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SQLite, an embedded database library used in many applications and devices, is affected by this flaw. An attacker who can supply crafted SQL or a malicious database view can cause the program using SQLite to run out of stack memory and crash.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- SQLite SQLite
fixed in 3.54.0