SQLite before version 3.54.0 contains a stack exhaustion flaw in the countOfViewOptimization() routine. When an attacker executes a count(*) over a large multi‑row VALUES clause, deeply nested TK_PLUS expressions are created and freed recursively in sqlite3ExprDeleteNN(), overwhelming the C stack and causing the host process to crash. The result is a denial of service – the database engine stops accepting further requests until it is restarted.

The issue affects the SQLite engine, specifically all builds prior to release 3.54.0. Any deployment using SQLite 3.53.x or earlier is susceptible, regardless of operating system or packaging.

The CVSS score of 6.8 places the flaw in the medium severity range, while no EPSS value is available for this vulnerability. It is not listed in CISA's KEV catalog. The exploit requires the attacker to supply crafted SQL or a database file containing a malicious view that triggers the vulnerable countOfViewOptimization() logic. This suggests that attackers with SQL injection or file upload capabilities can deliver the payload, making the attack vector likely through application‑level input but it is inferred rather than explicitly documented in the description.