UBUNTU-CVE-2026-119371: SQL Injection
Published Nov 3, 2026
·Updated
SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.
Affected Software
13 affected components
ubuntu/sqlite*
ubuntu/sqlite3*
ubuntu/sqlite3*
ubuntu/sqlite*
ubuntu/sqlite3*
ubuntu/sqlite*
ubuntu/sqlite3*
ubuntu/sqlite*
ubuntu/sqlite*
ubuntu/sqlite3*
ubuntu/sqlite3*
ubuntu/sqlite3*
ubuntu/sqlite3*
Event History
Nov 3, 2026
CVE Published
via OSV·12:00 AM
Data Sourced
via OSV·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploitation require database credentials or other privileges?
No privileges are required according to the CVSS vector. Exploitation does require user interaction and is locally reachable.
2
Can an attacker trigger the issue without submitting a direct SQL query to the application?
Yes. A malicious view embedded in an untrusted database file can trigger the recursive processing when the file is opened or used, in addition to a plain SQL WITH clause containing a very long CTE chain.