Hi,
The following vulnerabilities were published for sqlite3.
All should be fixed in the 3.54.0 upstream version, but please
double-check!
CVE-2026-119371[0]:
| SQLite before 3.54.0 contains a stack exhaustion vulnerability that
| allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit
| because common table expressions are not counted against it.
| Attackers can supply a WITH clause chaining tens of thousands of
| CTEs, via plain SQL or a view in an untrusted database file, causing
| unbounded selectExpander() recursion that crashes the process.
CVE-2026-119372[1]:
| SQLite before 3.54.0 built with FTS3/FTS4 and
| SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free
| vulnerability in fts3BestSnippet() caused by dangling cached
| position-list pointers. Attackers can run a full-text MATCH query
| combining OR and NEAR operators with snippet() to read freed heap
| memory and crash the process.
CVE-2026-119373[2]:
| SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow
| in fts5MergeRowidLists() that undersizes the output buffer when
| merging detail=none prefix doclists. Attackers who can populate a
| detail=none FTS5 table with negative rowids and run a prefix MATCH
| query can write past the allocation, corrupting heap memory and
| crashing the process.
CVE-2026-119374[3]:
| SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow
| in fts5DoSecureDelete() that allows attackers to write past the leaf
| page buffer via crafted footer key offsets. Attackers can supply a
| database file with a corrupted FTS5 index that, when deleted from
| with secure-delete enabled, corrupts heap memory and crashes the
| application.
CVE-2026-119375[4]:
| SQLite before 3.54.0 contains an information disclosure
| vulnerability that allows attackers to read uninitialized page-cache
| memory by supplying a WAL file with an undersized page size.
| Attackers can craft a database and WAL file whose oversized record
| payload makes queries like substr() return stale bytes, disclosing
| other table rows and internal pointers.
CVE-2026-119376[5]:
| SQLite before 3.54.0 contains a stack exhaustion vulnerability that
| allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by
| chaining COLLATE postfix operators. Attackers can supply roughly
| 175,000 chained COLLATE operators in SQL or an untrusted database
| view to trigger unbounded recursion in sqlite3WalkExprNN() and crash
| the process.
CVE-2026-119377[6]:
| SQLite before 3.54.0 contains an authorization bypass vulnerability
| in lookupName() that invokes the authorizer only for the first
| joined table's USING column. Attackers able to submit SQL can query
| a shared USING column in a RIGHT or FULL JOIN to read columns denied
| via sqlite3_set_authorizer() SQLITE_READ restrictions.
CVE-2026-119378[7]:
| SQLite before 3.54.0 contains a use-after-free vulnerability in the
| R-Tree extension that allows attackers to make applications use
| freed heap memory by manipulating the %_node shadow table. Attackers
| can supply a database declaring %_node WITHOUT ROWID or with a
| RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the
| process after node splits.
CVE-2026-119379[8]:
| SQLite before 3.54.0 built with the session extension contains a
| heap buffer overflow vulnerability in sqlite3changeset_apply() that
| allows attackers to corrupt heap memory by supplying crafted
| changesets. Attackers can repeat a table name in a second changeset
| block with a larger column count, causing sessionUpdateFind() to
| memset past the undersized aUpdateMask allocation.
CVE-2026-119586[9]:
| SQLite command-line shell through 3.54.1 contains a command
| injection vulnerability in the .recover command that emits attacker-
| planted dot-commands stored in sqlite_schema.sql values verbatim.
| Attackers can craft a database whose schema holds a valid CREATE
| statement followed by a .shell or .system line, executing OS
| commands when victims pipe .recover output into sqlite3.
CVE-2026-119591[10]:
| SQLite before 3.54.0 contains a stack exhaustion vulnerability in
| countOfViewOptimization() that allows attackers to crash the host
| process via count(*) over a large multi-row VALUES clause. Attackers
| supplying SQL or a database file with a crafted view can trigger
| deeply nested TK_PLUS expressions whose recursive freeing in
| sqlite3ExprDeleteNN() exhausts the C stack, causing denial of
| service.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-119371
https://www.cve.org/CVERecord?id=CVE-2026-119371
[1] https://security-tracker.debian.org/tracker/CVE-2026-119372
https://www.cve.org/CVERecord?id=CVE-2026-119372
[2] https://security-tracker.debian.org/tracker/CVE-2026-119373
https://www.cve.org/CVERecord?id=CVE-2026-119373
[3] https://security-tracker.debian.org/tracker/CVE-2026-119374
https://www.cve.org/CVERecord?id=CVE-2026-119374
[4] https://security-tracker.debian.org/tracker/CVE-2026-119375
https://www.cve.org/CVERecord?id=CVE-2026-119375
[5] https://security-tracker.debian.org/tracker/CVE-2026-119376
https://www.cve.org/CVERecord?id=CVE-2026-119376
[6] https://security-tracker.debian.org/tracker/CVE-2026-119377
https://www.cve.org/CVERecord?id=CVE-2026-119377
[7] https://security-tracker.debian.org/tracker/CVE-2026-119378
https://www.cve.org/CVERecord?id=CVE-2026-119378
[8] https://security-tracker.debian.org/tracker/CVE-2026-119379
https://www.cve.org/CVERecord?id=CVE-2026-119379
[9] https://security-tracker.debian.org/tracker/CVE-2026-119586
https://www.cve.org/CVERecord?id=CVE-2026-119586
[10] https://security-tracker.debian.org/tracker/CVE-2026-119591
https://www.cve.org/CVERecord?id=CVE-2026-119591
Regards,
Salvatore