CVE-2026-119371

6.8 medium

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.

Severity

CVSS 4.0

6.8 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE: CWE-674
Published: 2026-10-30
Modified: 2026-10-30
Record from: the NVD, synced 2026-10-30

References

https://abraxaslabs.tech/research/sqlite-cte-nest
https://github.com/sqlite/sqlite
https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754
https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb
https://sqlite.org/bugs/info/2026-10-04T04:58:58Z

Check your stack JSON