{"id":"CVE-2026-119591","kind":"vulnerability","aliases":["CVE-2026-119591"],"related":[],"title":"SQLite: deep expression nesting in count(*) exhausts the stack, crashing the process","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.","summary":"SQLite versions before 3.54.0 contain a stack exhaustion bug in countOfViewOptimization(). A crafted query over a large multi-row VALUES clause, or a database file with a crafted view, can crash the host process, causing denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded-db","mobile","node","package","python","sqlite"],"not_affected_if":["sqlite-3.54.0-or-later","trusted-sql-only"],"how_to_check":"- Run `sqlite3 --version` or check the bundled SQLite version in your application's dependencies\n- Search your dependency lockfiles for SQLite versions below `3.54.0`","fix":"- SQLite: move to `3.54.0` or later","status":"open","published_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:27+00:00","triaged_at":"2026-10-30T12:32:30+00:00","updated_at":"2026-10-30T12:32:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T12:32:30Z","model":"claude-haiku-5-5","output":{"fix":"- SQLite: move to `3.54.0` or later","reach":"unknown","title":"SQLite: deep expression nesting in count(*) exhausts the stack, crashing the process","impact":"low","summary":"SQLite versions before 3.54.0 contain a stack exhaustion bug in countOfViewOptimization(). A crafted query over a large multi-row VALUES clause, or a database file with a crafted view, can crash the host process, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["sqlite","embedded-db","python","node","mobile"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Host process crashes, causing denial of service","analyst_note":"","how_to_check":"- Run `sqlite3 --version` or check the bundled SQLite version in your application's dependencies\n- Search your dependency lockfiles for SQLite versions below `3.54.0`\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-sql-only","sqlite-3.54.0-or-later"],"who_is_affected":"Applications that embed SQLite and run SQL or open database files from untrusted sources are exposed, since the crash is triggered by the query or view content. Applications that only query their own trusted databases with fixed SQL are less exposed. unknown for finer detail.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000675,"input_tokens":4182,"output_tokens":513,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119591':15A,18A '-2026':14A,17A '3.54.0':30B,68C 'allow':77C 'attack':78C,94C 'bug':35B 'c':119C 'caus':62B,121C 'claus':48B,93C 'contain':31B,69C 'count':6A,85C 'countofviewoptim':37B,75C 'craft':39B,55B,103C 'crash':10A,58B,80C 'cve':13A,16A 'databas':51B,99C 'db':21B 'deep':2A 'deepli':107C 'denial':63B,122C 'embed':20B 'embedded-db':19B 'exhaust':7A,34B,72C,117C 'express':3A,111C 'file':52B,100C 'free':114C 'host':60B,82C 'larg':43B,88C 'mobil':22B 'multi':45B,90C 'multi-row':44B,89C 'nest':4A,108C 'node':23B 'packag':24B 'plus':110C 'process':12A,61B,83C 'python':25B 'queri':40B 'recurs':113C 'row':46B,91C 'servic':65B,124C 'sql':96C 'sqlite':1A,26B,27B,66C 'sqlite3exprdeletenn':116C 'stack':9A,33B,71C,120C 'suppli':95C 'tk':109C 'trigger':106C 'valu':47B,92C 'version':28B 'via':84C 'view':56B,104C 'vulner':73C 'whose':112C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed SQLite and run SQL or open database files from untrusted sources are exposed, since the crash is triggered by the query or view content. Applications that only query their own trusted databases with fixed SQL are less exposed. unknown for finer detail.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119591","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119591","severity":null,"published_at":"2026-10-30T12:16:44+00:00","modified_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:27+00:00","fetched_at":"2026-10-30T12:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}