SQLite prior to version 3.54.0 contains a stack exhaustion flaw in the selectExpander() routine where common table expressions are not counted against the SQLITE_LIMIT_EXPR_DEPTH limit. An attacker can craft a WITH clause that chains thousands of CTEs, either supplied as raw SQL or through a view in an untrusted database file, which forces unbounded recursion and ultimately crashes the SQLite process. The vulnerability is therefore a denial‑of‑service condition triggered by excessive recursion. The weakness corresponds to CWE‑674, uncontrolled recursion.

The flaw affects all SQLite releases earlier than 3.54.0. Any system that embeds SQLite and can load untrusted database files or accepts arbitrary SQL statements is susceptible, including applications on desktop, mobile, or embedded platforms that use SQLite as the storage engine. The vendor’s product line is SQLite:SQLite, and the affected range is all versions less than 3.54.0.

The CVSS base score is 6.8, indicating a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so no evidence of active exploitation is known. The likely attack vector is the ability to supply a malicious SQL statement or load a malicious database file containing a deep CTE chain. Once the vulnerable code path is executed, the process terminates, leading to a denial of service for the application. Due to the absence of a validated exploit and the relatively moderate score, the risk is moderate, but the impact of a crash can be significant for high‑availability services.