CVE-2026-119376
Received Received - Intake

Stack Exhaustion via COLLATE Operators in SQLite

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119376
EUVD
EUVD-2026-113787

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SQLite SQLite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SQLite before 3.54.0 has a stack exhaustion vulnerability where attackers can bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. This involves supplying around 175,000 chained COLLATE operators in SQL or an untrusted database view, causing unbounded recursion in sqlite3WalkExprNN() and crashing the process.

Impact Analysis

This vulnerability can crash applications using vulnerable SQLite versions, leading to denial of service. Attackers could exploit it to disrupt services relying on SQLite databases, such as embedded systems or applications with local database storage.

Mitigation Strategies

Upgrade SQLite to version 3.54.0 or later to address the stack exhaustion vulnerability caused by chained COLLATE operators.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119376. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart