Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119371SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

Medium 5.5

In plain English

A medium-severity security flaw in SQLite from SQLite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 91.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12sqlite3no fix listedDEBIAN-CVE-2026-119371
Debian:13sqlite3no fix listedDEBIAN-CVE-2026-119371
Debian:14sqlite3no fix listedDEBIAN-CVE-2026-119371
Ubuntu:22.04:LTSsqliteno fix listedUBUNTU-CVE-2026-119371
Ubuntu:22.04:LTSsqlite3no fix listedUBUNTU-CVE-2026-119371
Ubuntu:24.04:LTSsqlite3no fix listedUBUNTU-CVE-2026-119371
Ubuntu:26.04:LTSsqlite3no fix listedUBUNTU-CVE-2026-119371
Ubuntu:26.10sqlite3no fix listedUBUNTU-CVE-2026-119371

Affected products (as reported)

VendorProductVersions
SQLite SQLite 0 – before 3.54.0

Weakness: CWE-674 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References