CVE-2026-119371
Received Received - Intake

SQLite Stack Exhaustion via Unbounded CTE Recursion

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119371
EUVD
EUVD-2026-113782

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SQLite SQLite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SQLite before version 3.54.0 allows attackers to cause a stack exhaustion by chaining tens of thousands of Common Table Expressions (CTEs) in a WITH clause. The SQLITE_LIMIT_EXPR_DEPTH nesting limit is bypassed because CTEs are not counted against it, leading to unbounded recursion in the selectExpander() function and crashing the process.

Detection Guidance

To detect this vulnerability, check the SQLite version in use. Run 'sqlite3 --version' to see if it is below 3.54.0. If so, the system is vulnerable. Additionally, test for stack exhaustion by crafting a query with deeply nested CTEs, such as a chain of 21,000 or more WITH clauses, and observe if the process crashes.

Impact Analysis

This vulnerability can crash applications processing untrusted SQL or opening malicious database files, causing denial-of-service. It may disrupt service availability but is not known to allow remote code execution. Systems using SQLite versions below 3.54.0 are affected.

Mitigation Strategies

Upgrade SQLite to version 3.54.0 or later. This version includes fixes to enforce the SQLITE_LIMIT_EXPR_DEPTH limit for CTEs, preventing stack exhaustion. If upgrading is not immediately possible, restrict access to untrusted SQL queries or database files to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119371. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart