CVE-2026-119376 in SQLite
Summary
by MITRE • 10/30/2026
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in SQLite versions prior to 3.54.0 represents a critical stack exhaustion flaw that undermines the integrity of resource limits designed to prevent denial-of-service conditions. Specifically, this issue affects the SQLITE_LIMIT_EXPR_DEPTH configuration parameter, which is intended to restrict the depth of expression evaluation within SQL queries to protect system stability. By exploiting a specific parsing behavior related to COLLATE postfix operators, an attacker can effectively bypass these protective boundaries. The core technical flaw lies in how the SQLite engine processes chained COLLATE operations during query compilation and execution. When multiple COLLATE clauses are applied sequentially to expressions, they trigger recursive calls within the internal function sqlite3WalkExprNN(). This function is responsible for walking through expression trees to perform various analyses, including type checking and optimization. However, due to insufficient depth tracking in this specific context, each chained operator adds a new frame to the call stack without properly decrementing or respecting the configured limit counter.
This architectural oversight allows an attacker to construct malicious SQL statements containing approximately 175,000 nested COLLATE operators. Upon processing such a query, the recursive nature of sqlite3WalkExprNN() leads to unbounded recursion that rapidly consumes available stack space. Since SQLite is often embedded within larger applications or run as part of web services and mobile applications, this resource exhaustion directly impacts the availability of the host process. The immediate operational impact is a crash of the application utilizing the vulnerable SQLite library. In environments where SQLite handles user-generated input, such as search queries in e-commerce platforms or data filtering in enterprise software, an attacker can deliberately trigger this condition to cause service outages. This constitutes a classic denial-of-service scenario where availability is compromised through resource exhaustion rather than unauthorized access to sensitive data.
From a classification perspective, this vulnerability aligns with CWE-789: Memory Excess, specifically manifesting as stack overflow due to uncontrolled recursion. It also relates to CWE-400: Uncontrolled Resource Consumption, as the attacker forces the system to allocate excessive memory resources beyond intended limits. In terms of offensive security frameworks, this exploit technique corresponds to ATT&CK T1499: Endpoint Denial of Service, where an adversary leverages software vulnerabilities to disrupt normal operations. The bypass mechanism specifically targets limit enforcement logic, which can be categorized under CWE-755: Improper Handling of Exceptional Conditions if the error handling fails to reset state or abort execution before stack corruption occurs.
Mitigation strategies for this vulnerability are primarily focused on upgrading the underlying database engine. Organizations must ensure that all instances of SQLite are updated to version 3.54.0 or later, where the parsing logic has been corrected to properly account for COLLATE operator depth within the expression limit checks. For applications unable to immediately upgrade, defensive coding practices should be implemented at the application layer. This includes validating and sanitizing SQL queries before they reach the database engine, specifically by limiting the complexity of expressions involving nested operators. Input validation rules should enforce strict limits on query length or nesting depth regardless of SQLite's internal configuration. Additionally, deploying runtime protection mechanisms such as stack canaries or memory safety wrappers in languages that interface with SQLite can provide an additional layer of defense against stack overflow attacks. Regular security audits and static code analysis tools configured to detect deep recursion patterns in SQL generation logic are also recommended to prevent the construction of malicious queries at development time.