Stack Exhaustion Vulnerability in SQLite by SQLITE

CVE-2026-119371

What is CVE-2026-119371?

The vulnerable versions of SQLite, specifically those prior to 3.54.0, enable potential attackers to exploit a stack exhaustion vulnerability by bypassing the SQLITE_LIMIT_EXPR_DEPTH nesting limit. This occurs because common table expressions (CTEs) are not included in the count against the limit. By supplying a WITH clause that incorporates an extensive chain of CTEs—potentially numbering in the tens of thousands—attackers can trigger unbounded recursion within the selectExpander() function. This could lead to application crashes due to excessive stack use, presenting significant risks, especially when untrusted database files are involved.

References