CVE-2026-119376

MEDIUM 5.5

SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

CWE	CWE-674
Vendor	sqlite
Product	sqlite
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for sqlite sqlite

Be the first to know when new medium vulnerabilities affecting sqlite sqlite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

SQLite / SQLite

0 < 3.54.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sqlite.org: https://sqlite.org/bugs/info/2026-10-04T04:50:56Z sqlite.org: https://sqlite.org/src/info/252c0b7bf5a727d2 github.com: https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 github.com: https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175 sqlite.org: https://sqlite.org/releaselog/3_54_0.html abraxaslabs.tech: https://abraxaslabs.tech/research/sqlite-collate-depth github.com: https://github.com/sqlite/sqlite vulncheck.com: https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain

Credits

Ke Han 🔍 Abraxas Labs D. Richard Hipp