AZL-111763: CVE-2026-119371 affecting package sqlite 3.44.0-4

Q: Does configuring SQLITE_LIMIT_EXPR_DEPTH prevent this issue?

No. The vulnerability bypasses SQLITE_LIMIT_EXPR_DEPTH because common table expressions are not counted toward the nesting limit.

Q: Can an untrusted SQLite database file trigger the crash without sending a direct SQL query?

Yes. A view in an untrusted database file can contain the crafted WITH clause and cause unbounded selectExpander() recursion when processed.

Q: What attacker-controlled input is required to exploit this?

The attacker needs to supply SQL, or an untrusted database file containing a view, with a WITH clause that chains tens of thousands of common table expressions.

Published Oct 30, 2026

Updated

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.

Affected Software

1 affected component

azure-linux/sqlite<=3.44.0-4

Event History

Oct 30, 2026

Advisory Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-119371

Frequently Asked Questions

Does configuring SQLITE_LIMIT_EXPR_DEPTH prevent this issue?

No. The vulnerability bypasses SQLITE_LIMIT_EXPR_DEPTH because common table expressions are not counted toward the nesting limit.

Can an untrusted SQLite database file trigger the crash without sending a direct SQL query?

Yes. A view in an untrusted database file can contain the crafted WITH clause and cause unbounded selectExpander() recursion when processed.

What attacker-controlled input is required to exploit this?

The attacker needs to supply SQL, or an untrusted database file containing a view, with a WITH clause that chains tens of thousands of common table expressions.

AZL-111763: CVE-2026-119371 affecting package sqlite 3.44.0-4

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Does configuring SQLITE_LIMIT_EXPR_DEPTH prevent this issue?

Can an untrusted SQLite database file trigger the crash without sending a direct SQL query?

What attacker-controlled input is required to exploit this?

Company

Resources

Contact

Frequently Asked Questions

Does configuring SQLITE_LIMIT_EXPR_DEPTH prevent this issue?

Can an untrusted SQLite database file trigger the crash without sending a direct SQL query?

What attacker-controlled input is required to exploit this?