CVE-2026-119591 in SQLite
Summary
by MITRE • 10/30/2026
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in SQLite versions prior to 3.54.0 represents a critical resource exhaustion flaw located within the query optimization logic, specifically affecting the countOfViewOptimization function. This issue arises from an improper handling of complex SQL constructs involving multi-row VALUES clauses combined with aggregate functions such as COUNT(*). When a user supplies a crafted database file or executes specific SQL queries that define views containing deeply nested TK_PLUS expressions, the internal expression tree becomes excessively deep. The core technical failure lies in how SQLite manages memory and execution flow during the recursive deletion of these expression nodes via the sqlite3ExprDeleteNN function. Because this cleanup process relies on recursion without adequate depth limiting mechanisms, it consumes stack space at an exponential rate relative to the complexity of the input structure.
From a technical perspective, this is a classic example of uncontrolled resource consumption leading to a denial of service condition. The recursive nature of the expression tree traversal means that each level of nesting adds significant overhead to the call stack. In environments where SQLite operates with limited stack sizes or under high concurrency, even moderately complex crafted inputs can trigger rapid stack exhaustion. This results in an immediate crash of the host process rather than a graceful error return. Such behavior is particularly dangerous because it allows remote attackers who have access to execute SQL statements against vulnerable instances to disrupt service availability without requiring authentication if the database interface is exposed publicly or through untrusted channels.
The operational impact of this vulnerability extends beyond simple application crashes. In web applications, mobile apps, or embedded systems that utilize SQLite for local data storage and processing, a crash can lead to data corruption if transactions are not properly rolled back due to abrupt termination. Furthermore, the inability to process legitimate queries during the incident creates a significant availability gap. For organizations relying on SQLite in production environments where uptime is critical, this flaw poses a severe risk to business continuity. Attackers do not need sophisticated exploit chains; they merely need to construct specific SQL payloads that trigger the deep recursion within the view optimization logic, making exploitation straightforward and reliable.
This vulnerability aligns with CWE-789, which describes memory exhaustion due to uncontrolled resource consumption, specifically manifesting as stack overflow in this context. It also maps closely to MITRE ATT&CK technique T1499, Endpoint Denial of Service, where adversaries aim to degrade or disrupt the availability of targeted resources by exhausting system capacity. The specific mechanism involves manipulating internal parser and optimizer states to force excessive recursive calls that exceed available stack memory limits defined by the operating environment.
Mitigation strategies must prioritize immediate patching to version 3.54.0 or later, where this issue has been resolved through improved handling of expression tree depth and recursion limits within the optimization routines. For environments unable to update immediately, defensive coding practices should be implemented at the application layer. This includes strict input validation for SQL queries, particularly those involving complex subqueries, views, and multi-row value insertions. Implementing query complexity thresholds or timeout mechanisms can help prevent excessively deep recursive operations from consuming excessive resources. Additionally, deploying web application firewalls with rules designed to detect anomalous SQL patterns may provide an additional layer of defense against exploitation attempts targeting this specific weakness in older SQLite deployments.