SQLite versions prior to 3.54.0 can exhaust the process stack by allowing a user to construct a chain of COLLATE postfix operators in a SQL statement or an untrusted database view. The chained operators trigger unbounded recursion in sqlite3WalkExprNN(), bypassing the SQLITE_LIMIT_EXPR_DEPTH limit and resulting in a process crash. This flaw gives an attacker the ability to cause a denial of service on any system that loads the vulnerable library and processes untrusted SQL input.

The vulnerability affects all installations of SQLite that use a version earlier than 3.54.0. Any application or environment that loads the legacy library and accepts user‑supplied SQL statements, including web, mobile, or embedded databases, is potentially impacted.

The CVSS v3 score of 6.8 indicates a medium severity risk. Since the EPSS score is not available, the current public exploit probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable by feeding a long chain of COLLATE operators through SQL injection or by creating a malicious database view that contains the chain. An attacker therefore has a realistic path to crash the database process and disrupt availability, provided they control or influence the SQL sent to the database.