Live › vulnerability › CVE-2026-119591
SQLite versions before 3.54.0 contain a stack exhaustion bug in countOfViewOptimization(). A crafted query over a large multi-row VALUES clause, or a database file with a crafted view, can crash the host process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Applications that embed SQLite and run SQL or open database files from untrusted sources are exposed, since the crash is triggered by the query or view content. Applications that only query their own trusted databases with fixed SQL are less exposed. unknown for finer detail.
No product ranges from the sources yet.
sqlite3 --version or check the bundled SQLite version in your application's dependencies3.54.03.54.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-119591")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.