SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process.

Etkilenen sürümler1 yazılım

Kaynaklar10 kaynak

• CVE.org kaydı
• NVD kaydı
• sqlite.org/src/info/f54730871303e655 Yama
• github.com/…ommit/e6ff280c839fdfc7418fd5add12e8f32702a17fb Yama
• sqlite.org/bugs/info/2026-10-04T04:58:58Z Üçüncü taraf
• abraxaslabs.tech/research/sqlite-cte-nest Üçüncü taraf
• vulncheck.com/…ack-exhaustion-via-cte-chain-in-selectexpander Üçüncü taraf
• github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c Diğer
• sqlite.org/releaselog/3_54_0.html Diğer
• github.com/sqlite/sqlite Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:30Yayımlandı

İlgili açıklar

• 7,8 CVE-2026-119586SQLite CLI through 3.54.1 Command Injection via .recover Output
• 5,5 CVE-2026-119591SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
• 7,8 CVE-2026-119379SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
• 5,5 CVE-2026-119378SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
• 5,5 CVE-2026-119376SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
• 2,5 CVE-2026-119377SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING