CVE-2026-119376 SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

What is CVE-2026-119376?

CVE-2026-119376 is a medium-severity vulnerability in SQLite, published on 30 Oct 2026.

Official description

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

Weakness: CWE-674

Which versions are affected by CVE-2026-119376?

It affects 1 product.

Products include SQLite.

How do I fix CVE-2026-119376?

Upgrade to a fixed version.

Is CVE-2026-119376 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119376 exists.

Other vulnerabilities in SQLite

• CVE-2015-5895 Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors. Critical 10.0
• CVE-2020-35527 In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause. Critical 9.8
• CVE-2019-8457 SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables. Critical 9.8
• CVE-2017-10989 The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blob Critical 9.8
• CVE-2026-119373 SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists() High 8.5

All SQLite vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-111778, DEBIAN-CVE-2026-119376, ECHO-dd5e-c023-39e1, GHSA-8chh-5w6j-2xwf, UBUNTU-CVE-2026-119376.