CVE-2026-119376

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119376", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T00:57:05.506Z", "datePublished": "2026-10-30T11:30:41.213Z", "dateUpdated": "2026-11-04T02:07:18.766Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:41.213Z"}, "datePublic": "2026-10-04T00:00:00.000Z", "title": "SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain", "descriptions": [{"lang": "en", "value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Uncontrolled Recursion", "cweId": "CWE-674", "type": "CWE"}]}], "affected": [{"vendor": "SQLite", "product": "SQLite", "collectionURL": "https://sqlite.org/", "repo": "https://github.com/sqlite/sqlite", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThan": "3.54.0"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.54.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z", "tags": ["issue-tracking"]}, {"url": "https://sqlite.org/src/info/252c0b7bf5a727d2", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175", "tags": ["technical-description"]}, {"url": "https://sqlite.org/releaselog/3_54_0.html", "tags": ["release-notes"]}, {"url": "https://abraxaslabs.tech/research/sqlite-collate-depth", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sqlite/sqlite", "tags": ["product"]}, {"name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"}], "credits": [{"lang": "en", "value": "Ke Han", "type": "finder"}, {"lang": "en", "value": "Abraxas Labs", "type": "reporter"}, {"lang": "en", "value": "D. Richard Hipp", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T02:06:58.294941Z", "id": "CVE-2026-119376", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T02:07:18.766Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119376", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T02:06:58.294941Z"}}}], "references": [{"url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T02:07:14.105Z"}}], "cna": {"title": "SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain", "credits": [{"lang": "en", "type": "finder", "value": "Ke Han"}, {"lang": "en", "type": "reporter", "value": "Abraxas Labs"}, {"lang": "en", "type": "remediation developer", "value": "D. Richard Hipp"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/sqlite/sqlite", "vendor": "SQLite", "product": "SQLite", "versions": [{"status": "affected", "version": "0", "lessThan": "3.54.0", "versionType": "custom"}], "collectionURL": "https://sqlite.org/", "defaultStatus": "unaffected"}], "datePublic": "2026-10-04T00:00:00.000Z", "references": [{"url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z", "tags": ["issue-tracking"]}, {"url": "https://sqlite.org/src/info/252c0b7bf5a727d2", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2", "tags": ["patch"]}, {"url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175", "tags": ["technical-description"]}, {"url": "https://sqlite.org/releaselog/3_54_0.html", "tags": ["release-notes"]}, {"url": "https://abraxaslabs.tech/research/sqlite-collate-depth", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sqlite/sqlite", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain", "name": "VulnCheck Advisory: SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "Uncontrolled Recursion"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.54.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-30T11:30:41.213Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119376", "state": "PUBLISHED", "dateUpdated": "2026-11-04T02:07:18.766Z", "dateReserved": "2026-10-30T00:57:05.506Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-30T11:30:41.213Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://sqlite.org/", "defaultStatus": "unaffected", "product": "SQLite", "repo": "https://github.com/sqlite/sqlite", "vendor": "SQLite", "versions": [{"lessThan": "3.54.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D7328A9-932D-4FD4-8F44-90B87CAA8C4A", "versionEndExcluding": "3.54.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."}], "id": "CVE-2026-119376", "lastModified": "2026-11-04T02:17:19.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119376", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T02:06:58.294941Z", "version": "2.0.3"}}]}, "published": "2026-10-30T12:16:36.490", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://abraxaslabs.tech/research/sqlite-collate-depth"}, {"source": "disclosure@vulncheck.com", "tags": ["Product"], "url": "https://github.com/sqlite/sqlite"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175"}, {"source": "disclosure@vulncheck.com", "tags": ["Patch"], "url": "https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking"], "url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z"}, {"source": "disclosure@vulncheck.com", "tags": ["Release Notes"], "url": "https://sqlite.org/releaselog/3_54_0.html"}, {"source": "disclosure@vulncheck.com", "tags": ["Issue Tracking"], "url": "https://sqlite.org/src/info/252c0b7bf5a727d2"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Issue Tracking"], "url": "https://sqlite.org/bugs/info/2026-10-04T04:50:56Z"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "sqlite: sqlite: Denial of Service via stack exhaustion from chained COLLATE operators", "id": "2563943", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563943"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.", "A flaw was found in SQLite. An attacker can cause a Denial of Service (DoS) by supplying specially crafted SQL queries or an untrusted database view containing deeply chained COLLATE operators. This flaw bypasses expression depth limitations, triggering unbounded recursion and stack exhaustion that crashes the application process."], "mitigation": {"lang": "en:us", "value": "Upgrade to sqlite >= 3.54.0; avoid processing untrusted SQL/database views."}, "name": "CVE-2026-119376", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "mingw-sqlite", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "rust-toolset:rhel8/rust", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:26/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "sqlite", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-30T11:30:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119376\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119376\nhttps://abraxaslabs.tech/research/sqlite-collate-depth\nhttps://github.com/sqlite/sqlite\nhttps://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175\nhttps://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2\nhttps://sqlite.org/bugs/info/2026-10-04T04:50:56Z\nhttps://sqlite.org/releaselog/3_54_0.html\nhttps://sqlite.org/src/info/252c0b7bf5a727d2\nhttps://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"], "statement": "This vulnerability is rated as having a Moderate impact for Red Hat environments because exploitation typically requires user interaction or an application accepting arbitrary, unvalidated SQL statements from untrusted sources, resulting solely in a denial of service. In standard Red Hat Enterprise Linux installations, SQLite functions primarily as an embedded storage backend where applications execute internally controlled queries rather than arbitrary external syntax. Consequently, risk is confined to scenarios where host services process hostile database files or unauthenticated external input containing thousands of collation clauses, crashing only the invoking process.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.54.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "SQLite", "source": "cna", "vendor": "SQLite"}, "product": "sqlite", "vendor": "sqlite"}], "created": "2026-10-30T12:30:14.124484+00:00", "updated": "2026-11-06T02:30:14.086674+00:00", "vendors": ["sqlite", "sqlite$PRODUCT$sqlite"], "weaknesses": ["CWE-674", "CWE-770"]}