CVE-2026-119371: SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

Published Oct 30, 2026

Updated

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.

Other sources

SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

— Microsoft

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Oct 31, 2026

Data Sourced

via Microsoft·08:04 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using SQLite versions before 3.54.0 are exposed if they process attacker-supplied SQL or open untrusted SQLite database files that may contain views.

What does an attacker need to trigger the crash?

An attacker needs a way to provide SQL containing a WITH clause with tens of thousands of chained CTEs, either directly as SQL input or indirectly through a view stored in an untrusted database file. No privileges are required, but user interaction is required according to the supplied vector.

What is the impact of successful exploitation?

The chained CTEs cause unbounded recursion in selectExpander(), exhausting the stack and crashing the SQLite-using process. The provided impact metrics indicate availability impact only, with no stated confidentiality or integrity impact.

Does SQLITE_LIMIT_EXPR_DEPTH mitigate this issue?

No. The issue exists because common table expressions are not counted toward SQLITE_LIMIT_EXPR_DEPTH, allowing attackers to bypass that nesting limit.

What can be done if upgrading is not immediately possible?

Avoid executing untrusted SQL and avoid opening untrusted SQLite database files, particularly files that may contain attacker-controlled views. These are the identified delivery paths for the CTE chain.

CVE-2026-119371: SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

Other sources

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the crash?

What is the impact of successful exploitation?

Does SQLITE_LIMIT_EXPR_DEPTH mitigate this issue?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the crash?

What is the impact of successful exploitation?

Does SQLITE_LIMIT_EXPR_DEPTH mitigate this issue?

What can be done if upgrading is not immediately possible?