PatchTheCVECVE-2026-119376: SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMI
CVE-2026-119376 is a medium-severity flaw (CVSS 5.5) affecting sqlite. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 95%) |
| CISA exploited list | No |
| Weakness | CWE-674 |
| Published | 2026-10-30 |
| Last modified | 2026-11-02 |
Last updated 2026-11-02 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- VulDB Recent Entries: CVE-2026-119376 | SQLite up to 3.53.x Expression Walker sqlite3WalkExprNN stack-based overflow 2026-10-30
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-119376?
sqlite: upgrade to 3.54.0. Exact commands for each OS are on this page.
Is CVE-2026-119376 being exploited?
CVE-2026-119376 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-119376 affect?
CVE-2026-119376 affects sqlite. Severity is medium (CVSS 5.5). SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or
How urgent is CVE-2026-119376?
Priority 25/100. Public exploit reference
Software pages
SQLite vulnerabilities · Postfix vulnerabilities
Related CVEs
- CVE-2026-11822 MEDIUM 5.5 UPGRADE SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that
- CVE-2025-70873 HIGH 7.5 UPGRADE An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and
- CVE-2025-6965 HIGH 7.7 UPGRADE UPGRADE There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed
- CVE-2025-3277 CRITICAL 9.8 UPGRADE An integer overflow can be triggered in SQLite’s `concat_ws()` function
- CVE-2025-29088 MEDIUM 5.6 DOWNGRADE In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause