Threats tagged 'ghsa-v8vq-8vgf-h9mg'

SQLite versions before 3.54.0 have a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit. This occurs because common table expressions (CTEs) are not counted against this limit. An attacker can supply a WITH clause chaining tens of thousands of CTEs, either via plain SQL or a view in an untrusted database file, causing unbounded recursion in selectExpander() that crashes the process.