Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4111
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
FAQs regarding Amazon Linux ALAS/CVE Severity
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers. (CVE-2026-119375)
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process. (CVE-2026-119376)
SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits. (CVE-2026-119378)
Affected Packages:
sqlite
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update sqlite or yum update --advisory ALAS2-2026-4111 to update your system.
aarch64:
sqlite-3.7.17-8.amzn2.1.4.aarch64
sqlite-devel-3.7.17-8.amzn2.1.4.aarch64
lemon-3.7.17-8.amzn2.1.4.aarch64
sqlite-tcl-3.7.17-8.amzn2.1.4.aarch64
sqlite-debuginfo-3.7.17-8.amzn2.1.4.aarch64
i686:
sqlite-3.7.17-8.amzn2.1.4.i686
sqlite-devel-3.7.17-8.amzn2.1.4.i686
lemon-3.7.17-8.amzn2.1.4.i686
sqlite-tcl-3.7.17-8.amzn2.1.4.i686
sqlite-debuginfo-3.7.17-8.amzn2.1.4.i686
noarch:
sqlite-doc-3.7.17-8.amzn2.1.4.noarch
src:
sqlite-3.7.17-8.amzn2.1.4.src
x86_64:
sqlite-3.7.17-8.amzn2.1.4.x86_64
sqlite-devel-3.7.17-8.amzn2.1.4.x86_64
lemon-3.7.17-8.amzn2.1.4.x86_64
sqlite-tcl-3.7.17-8.amzn2.1.4.x86_64
sqlite-debuginfo-3.7.17-8.amzn2.1.4.x86_64