Skip to content
OpenAdvisories
High RHSA-2026:86202 10 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 lemon 0:3.54.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 sqlite 0:3.54.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 sqlite-analyzer 0:3.54.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 sqlite-debug 0:3.54.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 sqlite-devel 0:3.54.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 sqlite-doc 0:3.54.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 sqlite-libs 0:3.54.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 sqlite-tcl 0:3.54.1-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 sqlite-tools 0:3.54.1-1.hum1

Vulnerabilities 10

  • High 7.8
    CVE-2026-119373

    SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-119374

    SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()

    SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when d…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-119379

    SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()

    SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changes…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-119371

    SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

    SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-119372

    SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()

    SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operato…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-119375

    SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch

    SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payloa…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux crates.io
  • Medium 5.5
    CVE-2026-119376

    SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain

    SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted datab…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-119378

    SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()

    SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or wi…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2026-119591

    SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause

    SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can t…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux
  • Low 2.5
    CVE-2026-119377

    SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING

    SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read column…

    SQLite SQLite sqlite3 sqlite3 Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-119376
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-119374
  • report
    https://access.redhat.com/security/cve/CVE-2026-119375
  • report
    https://access.redhat.com/security/cve/CVE-2026-119373
  • report
    https://access.redhat.com/security/cve/CVE-2026-119372
  • report
    https://access.redhat.com/security/cve/CVE-2026-119377
  • report
    https://access.redhat.com/security/cve/CVE-2026-119371
  • report
    https://access.redhat.com/security/cve/CVE-2026-119379
  • report
    https://access.redhat.com/security/cve/CVE-2026-119378
  • report
    https://access.redhat.com/security/cve/CVE-2026-119591
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_86202.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2564005
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-119371
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-119371
  • article
    https://abraxaslabs.tech/research/sqlite-cte-nest
  • article
    https://github.com/sqlite/sqlite
  • article
    https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754
  • article
    https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb
  • article
    https://sqlite.org/bugs/info/2026-10-04T04:58:58Z
  • article
    https://sqlite.org/releaselog/3_54_0.html
  • article
    https://sqlite.org/src/info/f54730871303e655
  • article
    https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2564015
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-119372
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-119372
  • article
    https://abraxaslabs.tech/research/sqlite-fts3-snippet
  • article
    https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561
  • article
    https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731
  • article
    https://sqlite.org/bugs/info/2026-08-17T09:18:24Z
  • article
    https://sqlite.org/src/info/e4635c4153
  • article
    https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2563953
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-119373
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-119373
  • article
    https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge
  • article
    https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107
  • article
    https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80