Stack Exhaustion Vulnerability in SQLite Affected by Improper Handling of Multi-row VALUES Clause

CVE-2026-119591

What is CVE-2026-119591?

An identified stack exhaustion vulnerability in SQLite versions prior to 3.54.0 allows attackers to trigger a denial of service condition. This occurs during the execution of a SQL query involving a large multi-row VALUES clause, particularly when crafted views are supplied. The exploitation leverages deeply nested expressions that lead to excessive recursion in the memory management function sqlite3ExprDeleteNN(), causing the C stack to be exhausted. As a result, an attacker can crash the host process, leading to service disruptions.

References