new file mode 100644
@@ -0,0 +1,103 @@
+From e6ff280c839fdfc7418fd5add12e8f32702a17fb Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Mon, 5 Oct 2026 09:32:24 +0000
+Subject: [PATCH] Limit the depth of recursion for CTEs using
+ SQLITE_LIMIT_EXPR_DEPTH. [bugs:/info/2026-10-04T04:58:58Z|Bug
+ 2026-10-04T04:58:58Z].
+
+FossilOrigin-Name: f54730871303e655a70f3167ce1a39dcd4e53fcf017d225f429e2bb67ad96604
+
+CVE: CVE-2026-119371
+Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb]
+
+Backport Changes:
+- Ported src/select.c changes into the amalgamated sqlite3.c file.
+- Omitted test/with2.test because the extracted source lacks the
+ upstream Tcl test tree.
+- Omitted manifest and manifest.uuid because they are Fossil metadata.
+
+Signed-off-by: Arpit Patel <arpitpa@cisco.com>
+---
+ sqlite3.c | 36 ++++++++++++++++++++++++------------
+ 1 file changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 816b998..3432915 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -151472,6 +151472,20 @@ SQLITE_PRIVATE void sqlite3SubqueryColumnTypes(
+ pTab->szTabRow = 1; /* Any non-zero value works */
+ }
+
++/*
++** Check the current subquery nesting depth. Return true and set an
++** error if it has gone too deep.
++*/
++static int checkSubqueryNestingDepth(Parse *pParse){
++#if SQLITE_MAX_EXPR_DEPTH>0
++ if( pParse->nNestSel >= pParse->db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){
++ sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep");
++ return 1;
++ }
++#endif
++ return 0;
++}
++
+ /*
+ ** Given a SELECT statement, generate a Table structure that describes
+ ** the result set of that SELECT.
+@@ -151482,12 +151496,7 @@ SQLITE_PRIVATE Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, c
+ u64 savedFlags;
+
+ pParse->nNestSel++;
+-#if SQLITE_MAX_EXPR_DEPTH>0
+- if( pParse->nNestSel >= db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){
+- sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep");
+- return 0;
+- }
+-#endif
++ if( checkSubqueryNestingDepth(pParse) ) return 0;
+ savedFlags = db->flags;
+ db->flags &= ~(u64)SQLITE_FullColNames;
+ db->flags |= SQLITE_ShortColNames;
+@@ -154703,14 +154712,13 @@ SQLITE_PRIVATE With *sqlite3WithPush(Parse *pParse, With *pWith, u8 bFree){
+ }
+
+ /*
+-** This function checks if argument pFrom refers to a CTE declared by
++** This function checks to see if argument pFrom refers to a CTE declared by
+ ** a WITH clause on the stack currently maintained by the parser (on the
+-** pParse->pWith linked list). And if currently processing a CTE
+-** CTE expression, through routine checks to see if the reference is
+-** a recursive reference to the CTE.
++** pParse->pWith linked list). And if currently processing a CTE expression,
++** it also checks to see if the reference is a recursive reference to the CTE.
+ **
+-** If pFrom matches a CTE according to either of these two above, pFrom->pSTab
+-** and other fields are populated accordingly.
++** If pFrom matches a CTE, pFrom->pSTab and other fields are populated
++** accordingly.
+ **
+ ** Return 0 if no match is found.
+ ** Return 1 if a match is found.
+@@ -154839,6 +154847,8 @@ static int resolveFromTermToCte(
+ pRecTerm = pRecTerm->pPrior;
+ }
+
++ pParse->nNestSel++;
++ if( checkSubqueryNestingDepth(pParse) ) return 2;
+ pCte->zCteErr = "circular reference: %s";
+ pSavedWith = pParse->pWith;
+ pParse->pWith = pWith;
+@@ -154863,6 +154873,8 @@ static int resolveFromTermToCte(
+ }
+ }
+ pParse->pWith = pWith;
++ pParse->nNestSel--;
++ assert( pParse->nNestSel>=0 );
+
+ for(pLeft=pSel; pLeft->pPrior; pLeft=pLeft->pPrior);
+ pEList = pLeft->pEList;
+--
+2.35.6
+
@@ -32,6 +32,7 @@ SRC_URI += "file://0001-Add-option-to-disable-zlib.patch \
file://CVE-2026-119372.patch \
file://CVE-2026-119378.patch \
file://CVE-2026-119376.patch \
+ file://CVE-2026-119371.patch \
"
SRC_URI[sha256sum] = "0e9483900e92cd5de8fd48d16bf9200145a61f7fd5be542a5ac81d8a9516eb9c"
This patch applies the upstream CTE recursion limit [1]. It uses the expression-depth counter and limit already present in SQLite 3.53.4, so the prerequisite patch is not needed. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb [2] https://sqlite.org/src/info/f54730871303e655 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119371 Signed-off-by: Arpit Patel <arpitpa@cisco.com> --- .../sqlite/sqlite3/CVE-2026-119371.patch | 103 ++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.53.4.bb | 1 + 2 files changed, 104 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch