{"id":"CVE-2026-119591","aliases":[],"cve":{"records":[{"id":"CVE-2026-119591","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T11:20:35.123Z","published":"2026-10-30T11:31:15.714Z","modified":"2026-10-30T11:31:15.714Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T11:31:15.714Z"}],"references":[{"url":"https://sqlite.org/bugs/info/2026-10-04T05:34:47Z","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://sqlite.org/src/info/ab621a3e11ee4acc","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://sqlite.org/releaselog/3_54_0.html","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://abraxaslabs.tech/research/sqlite-values-union","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/sqlite/sqlite","tags":["product"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-674","description":"Uncontrolled Recursion","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*","versionEndExcluding":"3.54.0"}]}]}]}],"prioritization":[]},"title":"SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service.","score":6.8,"severity":"medium","published":"2026-10-30T11:31:15.714Z","modified":"2026-10-30T11:31:15.714Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"SQLite","name":"SQLite","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.54.0","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:github/sqlite/sqlite","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119591"}],"remediation":[],"references":["https://sqlite.org/bugs/info/2026-10-04T05:34:47Z","https://sqlite.org/src/info/ab621a3e11ee4acc","https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199","https://sqlite.org/releaselog/3_54_0.html","https://abraxaslabs.tech/research/sqlite-values-union","https://github.com/sqlite/sqlite","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"],"sources":[{"name":"CVE","id":"CVE-2026-119591","modified":"2026-10-30T11:31:15.714Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119591"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6.8},{"source":"VulnCheck","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.5}],"sourceAffected":[],"observedAt":"2026-10-30T11:37:10.416Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T05:25:31.914Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T11:40:30.841Z","attemptedAt":"2026-10-30T11:40:30.841Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T11:40:30.841Z","attemptedAt":"2026-10-30T11:40:30.841Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T11:40:30.841Z","attemptedAt":"2026-10-30T11:40:30.841Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T11:40:30.841Z","attemptedAt":"2026-10-30T11:40:30.841Z"}],"evidence":[],"aiSummary":{"text":"SQLite before 3.54.0 has a stack exhaustion vulnerability via countOfViewOptimization() in VALUES Clause, allowing attackers to crash the host process. Attackers can trigger this with a crafted SQL or database file. This causes a denial of service.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T11:41:09.018Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119591"}]}}