CVE-2026-119377

Description

References

• abraxaslabs.tech/research/sqlite-fj-using-auth · Exploit
• sqlite/sqlite · Product
• sqlite/sqlite · Product
• sqlite/sqlite commit 5694c3b · Patch
• sqlite/sqlite commit 7ff247c · Patch
• sqlite.org/bugs/info/2026-07-05T08:15:45Z · Issue Tracking
• sqlite.org/releaselog/3_54_0.html · Release Notes
• sqlite.org/src/info/2cb22877683680c1 · Issue Tracking
• sqlite.org/src/info/bbd69ce274620008 · Issue Tracking
• vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using · Third Party Advisory

More vulnerabilities in sqlite

• CVE-2026-119591MEDIUM 5.5SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process …
• CVE-2026-119586HIGH 7.8SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-…
• CVE-2026-119379HIGH 7.8SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows …
• CVE-2026-119378MEDIUM 5.5SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed he…
• CVE-2026-119376MEDIUM 5.5SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining…