sqlite-cte-nest

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · sqlite-cte-nest Write-up: https://abraxaslabs.tech/research/sqlite-cte-nest sqlite-cte-nest Class: Crash Reach: Local SQLite 3.53.4 b09c88c14082339b66c7b7158d609a771e64ca69, SOURCEID 2026-07-24 19:02:57...

SUSE CVE-2026-119371

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

Linux Distros Unpatched Vulnerability : CVE-2026-119371

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table...

AZL-111763 CVE-2026-119371 affecting package sqlite 3.44.0-4

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

DEBIAN-CVE-2026-119371

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

CVE-2026-119371

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

CVE-2026-119371

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

UBUNTU-CVE-2026-119371

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

CVE-2026-119371

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

CVE-2026-119371 SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

CVE-2026-119371 SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

CVE-2026-119371 SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

EUVD-2026-113782

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

CVE-2026-119371

Versions of SQLite prior to 3.54.0 are vulnerable to a stack exhaustion flaw (CWE-674) within the selectExpander() function. The root cause is that Common Table Expressions (CTEs) are not accounted for in the SQLITE_LIMIT_EXPR_DEPTH nesting limit. An attacker can exploit this by providing a WITH ...

CVE-2026-119371: SQLite: SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the…

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITELIMITEXPRDEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an...

PT-2026-133455

Name of the Vulnerable Software and Affected Versions SQLite versions prior to 3.54.0 Description A stack exhaustion issue exists where the SQLITE LIMIT EXPR DEPTH nesting limit is bypassed because common table expressions CTEs are not included in the count. An attacker can provide a WITH clause...

Astra Linux – vulnerability in sqlite3

In SQLite 3.30.1, selectExpander in select.c continues to perform WITH stack unwinding even after encountering a parsing error...

sqlite3:ossfuzz: Use-of-uninitialized-value in selectExpander

Detailed Report: https://oss-fuzz.com/testcase?key=6162609471815680 Project: sqlite3 Fuzzing Engine: libFuzzer Fuzz Target: ossfuzz Job Type: libfuzzermsansqlite3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: selectExpander sqlite3WalkSelect sqlite3SelectPr...

EUVD-2019-10772

Malware in sbrugna...

Security update for sqlite3

This update for sqlite3 fixes the following issues: CVE-2019-20218: Fixed a stack unwinding flaw in the selectExpander after a parsing error. bsc1160439 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...