new file mode 100644
@@ -0,0 +1,75 @@
+From 0e3ec7377ba0ef29b02e258e9fbb395d0d6dd431 Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Sun, 4 Oct 2026 21:54:17 +0000
+Subject: [PATCH] Fix expression tree depth calculations for COLLATE.
+ [bugs:/info/2026-10-04T04:50:56Z|Bug 2026-10-04T04:50:56Z]
+
+FossilOrigin-Name: 252c0b7bf5a727d29605672bb58e06c758173c276671df3e388a68294998b4d3
+
+CVE: CVE-2026-119376
+Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2]
+
+Backport Changes:
+- Ported the src/expr.c and src/sqliteInt.h changes into sqlite3.c
+ because the recipe source uses the amalgamated SQLite layout.
+- Omitted test/sqllimits1.test because the extracted source does not
+ include the upstream test tree.
+- Omitted manifest and manifest.uuid because they are Fossil
+ repository metadata and are not needed for this source patch.
+
+Signed-off-by: Arpit Patel <arpitpa@cisco.com>
+---
+ sqlite3.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 45ade42b16..603ca28a27 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -21992,8 +21992,8 @@ SQLITE_PRIVATE void sqlite3SetTextEncoding(sqlite3 *db, u8);
+ SQLITE_PRIVATE CollSeq *sqlite3ExprCollSeq(Parse *pParse, const Expr *pExpr);
+ SQLITE_PRIVATE CollSeq *sqlite3ExprNNCollSeq(Parse *pParse, const Expr *pExpr);
+ SQLITE_PRIVATE int sqlite3ExprCollSeqMatch(Parse*,const Expr*,const Expr*);
+-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(const Parse *pParse, Expr*, const Token*, int);
+-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(const Parse*,Expr*,const char*);
++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(Parse *pParse, Expr*, const Token*, int);
++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(Parse*,Expr*,const char*);
+ SQLITE_PRIVATE Expr *sqlite3ExprSkipCollate(Expr*);
+ SQLITE_PRIVATE Expr *sqlite3ExprSkipCollateAndLikely(Expr*);
+ SQLITE_PRIVATE int sqlite3CheckCollSeq(Parse *, CollSeq *);
+@@ -111640,23 +111640,29 @@ SQLITE_PRIVATE int sqlite3ExprDataType(const Expr *pExpr){
+ ** and the pExpr parameter is returned unchanged.
+ */
+ SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(
+- const Parse *pParse, /* Parsing context */
++ Parse *pParse, /* Parsing context */
+ Expr *pExpr, /* Add the "COLLATE" clause to this expression */
+ const Token *pCollName, /* Name of collating sequence */
+ int dequote /* True to dequote pCollName */
+ ){
+- if( pCollName->n>0 ){
++ if( pCollName->n>0 && pParse->nErr==0 ){
+ Expr *pNew = sqlite3ExprAlloc(pParse->db, TK_COLLATE, pCollName, dequote);
++ assert( pExpr!=0 );
+ if( pNew ){
+ pNew->pLeft = pExpr;
+ pNew->flags |= EP_Collate|EP_Skip;
++#if SQLITE_MAX_EXPR_DEPTH>0
++ pNew->nHeight = pExpr->nHeight+1;
++ sqlite3ExprCheckHeight(pParse, pNew->nHeight);
++ testcase( pParse->nErr>0 );
++#endif
+ pExpr = pNew;
+ }
+ }
+ return pExpr;
+ }
+ SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(
+- const Parse *pParse, /* Parsing context */
++ Parse *pParse, /* Parsing context */
+ Expr *pExpr, /* Add the "COLLATE" clause to this expression */
+ const char *zC /* The collating sequence name */
+ ){
+--
+2.35.6
+
@@ -19,4 +19,5 @@ SRC_URI += "\
file://CVE-2026-119379.patch \
file://CVE-2026-119372.patch \
file://CVE-2026-119378.patch \
+ file://CVE-2026-119376.patch \
"
This patch applies the upstream fix [1], which includes COLLATE expressions in expression tree depth calculations and prevents bypass of the expression depth limit. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 [2] https://sqlite.org/src/info/252c0b7bf5a727d2 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119376 Signed-off-by: Arpit Patel <arpitpa@cisco.com> --- .../sqlite/sqlite3/CVE-2026-119376.patch | 75 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 76 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch