SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://sqlite.org/src/info/252c0b7bf5a727d2 patch
- https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.8 · sqliteNVD modified 2026-10-30 11:30
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 8
- https://sqlite.org/bugs/info/2026-10-04T04:50:56Z issue-tracking
- https://sqlite.org/src/info/252c0b7bf5a727d2 patch
- https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 patch
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175 technical-description
- https://sqlite.org/releaselog/3_54_0.html release-notes
- https://abraxaslabs.tech/research/sqlite-collate-depth third-party-advisory
- https://github.com/sqlite/sqlite product
- https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain third-party-advisory