# CVE-2026-119591: SQLite stack exhaustion in countOfViewOptimization

Source: https://junglewise.ai/threats/cve-2026-119591-sqlite-before-3-54-0-contains-a-stack-exhaustion-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119591 · Severity: medium · CVSS 5.5 · Published 2026-10-30

SQLite is a lightweight database engine embedded in most mobile devices and many applications worldwide. A vulnerability in versions before 3.54.0 allows attackers to crash applications using SQLite by providing specially crafted SQL queries or database files. An attacker with the ability to supply SQL statements or a malicious database file can trigger a denial of service, causing the application to crash.

Technologies: [Sqlite](https://junglewise.ai/threats/technologies/sqlite-sqlite). Vendors: [SQLite](https://junglewise.ai/threats/vendors/sqlite).

## Quick answers

**Is CVE-2026-119591 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119591 being exploited in the wild.

**How severe is CVE-2026-119591?** Medium severity, with a CVSS score of 5.5, published 30 October 2026.

**Which products and versions are affected?** Sqlite before 3.54.0.

**Is there a fix for CVE-2026-119591?** Yes: fixed in SQLite 3.54.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119591 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-119591?** Check whether you run Sqlite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in SQLite 3.54.0

## Technical details

The vulnerability is a stack exhaustion flaw in the countOfViewOptimization() function triggered when processing COUNT(*) queries over large multi-row VALUES clauses. Deeply nested TK_PLUS expressions are generated, and their recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack. An attacker providing untrusted SQL or a crafted database file can trigger this condition; a fix exists in version 3.54.0.

## Affected products

- SQLite SQLite before 3.54.0

## Timeline

- 2026-10-30: disclosed
- 2026-10-30: advisory

## References

- [https://sqlite.org/](https://sqlite.org/)
- [https://abraxaslabs.tech/research/sqlite-values-union](https://abraxaslabs.tech/research/sqlite-values-union)

## Related threats

- [SQLite heap buffer overflow in session extension](https://junglewise.ai/threats/cve-2026-119379-sqlite-before-3-54-0-built-with-the-session-extension-contains-a)
- [SQLite use-after-free in R-Tree extension](https://junglewise.ai/threats/cve-2026-119378-sqlite-before-3-54-0-contains-a-use-after-free-vulnerability-in)
- [SQLite information disclosure via undersized WAL page cache](https://junglewise.ai/threats/cve-2026-119375-sqlite-before-3-54-0-contains-an-information-disclosure)
- [SQLite heap buffer overflow in FTS5 secure delete](https://junglewise.ai/threats/cve-2026-119374-sqlite-before-3-54-0-built-with-fts5-contains-a-heap-buffer)
- [SQLite heap buffer overflow in FTS5 rowid merge](https://junglewise.ai/threats/cve-2026-119373-sqlite-before-3-54-0-built-with-fts5-contains-a-heap-buffer)