abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  [email protected]  ·  sqlite-cte-nest

sqlite-cte-nest

Class: Crash Reach: Local

SQLite 3.53.4 (b09c88c14082339b66c7b7158d609a771e64ca69, SOURCE_ID 2026-07-24 19:02:57 bf7c7f30031888f4e796e429ab3978879485813aaca6f641c7b33e4e09459bcc) - Hwaci

sqlite3ResultSetOfSelect increments nNestSel and errors VIEWs and/or subqueries nested too deep when the chain hits SQLITE_LIMIT_EXPR_DEPTH. Nested VIEWs on this pin already hit that cap. CTE attach at select.c:5754 (sqlite3SrcItemAttachSubquery) does not increment nNestSel. selectExpander / sqlite3WalkSelect then recurse the CTE chain until the C stack dies.

A small CTE chain returns a row. Nested FROM at N=25000 is a parser Recursion limit and does not crash. Nested VIEWs at .limit expr_depth 20 error too-deep. CTE N=25000 is ASan stack-overflow. Not RCE.

ID	no CVE yet
Class	Crash (ASan stack-overflow in selectExpander; not demonstrated RCE)
Reach	Local (untrusted SQL or nested CTE schema)
CWE	CWE-674
CVSS	High: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Product	SQLite (GitHub mirror sqlite/sqlite)
Affected	3.53.4 (b09c88c); leftover of later trunk CTE nNestSel
Auth	untrusted SQL or a planted WITH chain
License	GNU Affero GPL v3.0
Lab	127.0.0.1:18810 only. ASan amalgamation. Crash witness.

What an attacker can do

Feed a long CTE chain, as SQL or as a VIEW body on an untrusted .db:

WITH c0 AS (SELECT 1),
     c1 AS (SELECT * FROM c0),
     ...
     cN AS (SELECT * FROM cN-1)
SELECT * FROM cN;

selectExpander walks each CTE as a nested FROM subquery. nNestSel never moves. The host process dies on the C stack. Nested VIEWs are already capped. Nested FROM hits the parser recursion limit. This leftover is the CTE attach path. SQLite does not eval the CTE names into a shell. Crash, not RCE.

How I found it

Twenty source hunts of https://github.com/sqlite/sqlite tag https://github.com/sqlite/sqlite/releases/tag/version-3.53.4. Nested VIEWs were capped on this pin (3f3fb9b638 / branch-3.53 38430aa5ed, 2026-06-16). CTE attach was not. Trunk f547308713 (2026-10-05) is after this GA.

Wrong turns already recorded: treating nested VIEWs as the crash (they error too-deep); treating nested FROM N=25000 as the crash (parser Recursion limit); taking a 5-CTE chain as proof the cap applies.

Lab

cd lab
./run.sh

Official sqlite-src-3530400 zip, ASan amalgamation, compose sqlite-cte-nest, published 127.0.0.1:18810. Bind it to loopback. Do not point this at anyone else's SQLite.

SUCCESS sqlite-cte-nest how=asan-stack-overflow crash-n=25000 small-cte=ok nested-views=too-deep nested-from=rejected SQLITE-CTE-NEST-WITNESS

The fix

Increment nNestSel on CTE attach the way sqlite3ResultSetOfSelect already does for VIEWs, and error at SQLITE_LIMIT_EXPR_DEPTH. Trunk f547308713 (2026-10-05, "Limit the depth of recursion for CTEs using SQLITE_LIMIT_EXPR_DEPTH") is that class of patch. It is not in 3.53.4.

References

• https://github.com/sqlite/sqlite tag https://github.com/sqlite/sqlite/releases/tag/version-3.53.4 (b09c88c14082339b66c7b7158d609a771e64ca69)
• Canonical https://sqlite.org/src SOURCE_ID 2026-07-24 19:02:57 bf7c7f30031888f4e796e429ab3978879485813aaca6f641c7b33e4e09459bcc
• src/select.c sqlite3ResultSetOfSelect (nNestSel++), CTE attach :5754
• src/walker.c sqlite3WalkSelectFrom subquery walk
• selectExpander / sqlite3SelectExpand
• Forum bug 2026-10-04T04:58:58Z; trunk f547308713