Vulnerability in SQLite

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

[ Fixes ]Fixes and patches

• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Advisories ]Government CERT advisories

• BSI CERT-Bund1 Nov 2026WID-SEC-2026-4260

  SQLite: Multiple vulnerabilities Translated from German

  CVE-2026-119375CVE-2026-119373CVE-2026-119379+8 more CVEs

[ References ]References

• abraxaslabs.tech/research/sqlite-collate-depthExploitThird Party Advisory
• github.com/sqlite/sqliteProduct
• github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.cPatch
• github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2Patch
• sqlite.org/bugs/info/2026-10-04T04:50:56ZIssue Tracking
• sqlite.org/releaselog/3_54_0.htmlRelease Notes
• sqlite.org/src/info/252c0b7bf5a727d2Issue Tracking
• www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator…Third Party Advisory