CVE-2026-119376

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion i...

CVE-2026-119376

Versions of SQLite prior to 3.54.0 are vulnerable to a stack exhaustion vulnerability caused by uncontrolled recursion in the sqlite3WalkExprNN() function. An attacker can bypass the SQLITE_LIMIT_EXPR_DEPTH limit by supplying approximately 175,000 chained COLLATE postfix operators within an SQL q...

CVE-2026-119376 SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion i...

EUVD-2026-113787

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion i...

PT-2026-133460

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE LIMIT EXPR DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursio...

sqlite-collate-depth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-collate-depth Write-up: https://abraxaslabs.tech/research/sqlite-collate-depth sqlite-collate-depth Class: Crash Reach: Local SQLite 3.53.4 b09c88c14082339b66c7b7158d609a771e64ca69, SOURCEID 2026-07-24 19:02:57...