AZL-111778

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111778.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-111778

Upstream

CVE-2026-119376

Published

2026-10-30T12:16:36Z

Modified

2026-11-01T05:31:57Z

Summary

CVE-2026-119376 affecting package sqlite 3.44.0-4

Details

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-119376

Affected packages

Azure Linux:3 / sqlite

Package

Name: sqlite
Purl: pkg:rpm/azure-linux/sqlite

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.44.0-4

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111778.json"