UBUNTU-CVE-2026-119591: SQL Injection
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count() over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TKPLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using affected SQLite versions are exposed when they process attacker-supplied SQL or open an attacker-controlled database file containing a crafted view. The impact is a crash of the host process rather than disclosure or modification of data.
What must an attacker provide to trigger the crash?
The attacker needs to cause SQLite to process count(*) over a large multi-row VALUES clause, directly through supplied SQL or indirectly through a crafted view in a database file. The input creates deeply nested TK_PLUS expressions that can exhaust the C stack during recursive cleanup.
What is the practical impact of successful exploitation?
Successful exploitation can terminate the process hosting SQLite through stack exhaustion. The supplied severity vector indicates no confidentiality or integrity impact, but high availability impact.