Skip to content
OpenAdvisories
Medium ALAS2023-2026-3452 7 CVEs

Moderate: sqlite security update (Amazon Linux 2023)

Published Nov 12, 2026 · Updated Nov 12, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-119378: SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits. CVE-2026-119377: SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions. CVE-2026-119376: SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process. CVE-2026-119375: SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers. CVE-2026-119373: SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process. CVE-2026-119372: SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process. CVE-2026-119371: SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.

Fixed packages 15

ReleasePackageFixed in
Amazon Linux · 2023 lemon 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 lemon-debuginfo 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-analyzer 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-analyzer-debuginfo 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-debuginfo 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-debugsource 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-devel 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-doc 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-libs 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-libs-debuginfo 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-tcl 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-tcl-debuginfo 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-tools 0:3.40.0-1.amzn2023.0.9
Amazon Linux · 2023 sqlite-tools-debuginfo 0:3.40.0-1.amzn2023.0.9

Vulnerabilities 7

  • High 7.8
    CVE-2026-119373

    SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-119371

    SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

    SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-119372

    SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()

    SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operato…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-119375

    SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch

    SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payloa…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux crates.io
  • Medium 5.5
    CVE-2026-119376

    SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

    SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted datab…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-119378

    SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()

    SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or wi…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Low 2.5
    CVE-2026-119377

    SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING

    SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read column…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-119371.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-119372.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-119373.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-119375.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-119376.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-119377.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-119378.html