CVE-2026-119591
Received Received - Intake

Stack Exhaustion in SQLite via Malicious SQL Query

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119591
EUVD
EUVD-2026-113835

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SQLite SQLite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SQLite before 3.54.0 involves a stack exhaustion issue in the countOfViewOptimization() function. Attackers can crash the host process by executing a count(*) query over a large multi-row VALUES clause. The attack involves a crafted view that triggers deeply nested TK_PLUS expressions, causing recursive freeing in sqlite3ExprDeleteNN() which exhausts the C stack leading to denial of service.

Detection Guidance

This vulnerability is specific to SQLite versions before 3.54.0 and involves a crafted SQL query causing stack exhaustion. To detect it, check the SQLite version on your system using 'sqlite3 --version'. If the version is below 3.54.0, the system is vulnerable. No network-specific detection commands are provided as this is a local vulnerability.

Impact Analysis

If you use an affected version of SQLite, an attacker could exploit this vulnerability to crash the application or system process handling the database. This could lead to service disruption, data unavailability, or potential data corruption if the crash occurs during critical operations.

Mitigation Strategies

Upgrade SQLite to version 3.54.0 or later to address the stack exhaustion vulnerability. If upgrading is not immediately possible, avoid using untrusted SQL queries or database files, especially those containing crafted views or large VALUES clauses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart