ALAS2023-2026-3452

References: CVE-2026-119371  CVE-2026-119372  CVE-2026-119373  CVE-2026-119375  CVE-2026-119376  CVE-2026-119377  CVE-2026-119378 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process. (CVE-2026-119371)

SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process. (CVE-2026-119372)

SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process. (CVE-2026-119373)

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers. (CVE-2026-119375)

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process. (CVE-2026-119376)

SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions. (CVE-2026-119377)

SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits. (CVE-2026-119378)

Issue Correction:
Run dnf update sqlite --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3452 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    sqlite-debuginfo-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-tools-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-libs-debuginfo-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-debugsource-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-tools-debuginfo-3.40.0-1.amzn2023.0.9.aarch64
    lemon-debuginfo-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-tcl-debuginfo-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-analyzer-debuginfo-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-analyzer-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-devel-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-libs-3.40.0-1.amzn2023.0.9.aarch64
    sqlite-tcl-3.40.0-1.amzn2023.0.9.aarch64
    lemon-3.40.0-1.amzn2023.0.9.aarch64

noarch:
    sqlite-doc-3.40.0-1.amzn2023.0.9.noarch

src:
    sqlite-3.40.0-1.amzn2023.0.9.src

x86_64:
    sqlite-debuginfo-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-tools-debuginfo-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-analyzer-debuginfo-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-libs-debuginfo-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-debugsource-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-tcl-debuginfo-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-tools-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-libs-3.40.0-1.amzn2023.0.9.x86_64
    lemon-debuginfo-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-analyzer-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-tcl-3.40.0-1.amzn2023.0.9.x86_64
    lemon-3.40.0-1.amzn2023.0.9.x86_64
    sqlite-devel-3.40.0-1.amzn2023.0.9.x86_64