Live › vulnerability › CVE-2026-119371
SQLite before 3.54.0 does not count common table expressions against its expression nesting limit, so a WITH clause with tens of thousands of CTEs makes the query planner recurse until the process crashes. An attacker who can supply SQL or open an untrusted database file with a crafted view can cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that embed SQLite and run SQL or open database files that an outside party can influence, such as user-uploaded databases or user-supplied queries. Applications that only run trusted, fixed queries against their own database files are unlikely to be exposed.
No product ranges from the sources yet.
sqlite3 --version or check the bundled SQLite version in your application's dependencies3.54.0 are affected; move to 3.54.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
This page as .md · .json · in your agent: get_signal("CVE-2026-119371")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.