Description:
A batch of six SQLite advisories (CVE-2026-51296, -51297, -51300, -51302, -51303, -51304) was published through the CVE program in late July 2026, rated up to CVSS 9.8-10.0 Critical, all claiming use-after-free flaws in SQLite's expression and JSON handling.
JFrog Security Research verified the claims against the SQLite source and found them fabricated: the advisories cite functions such as exprComputeOperands() that do not exist in the named version, reference line numbers past the end of the files they point at, and ship proof-of-concept payloads that do not crash anything. The reports appear to be LLM-generated, and the same GitHub account produced 54 bogus CVEs out of 55 in four days.
The practical impact is on downstream consumers rather than on SQLite: scanners flag the fake CVEs, and organisations spend triage and patching effort on vulnerabilities that do not exist, while the noise erodes trust in the CVE feed itself.
Severity: Major (fabricated Critical-rated records entered NVD and downstream scanners, causing widespread wasted remediation effort and polluting a trusted security data source; no exploitable flaw or data loss results, and the specific records have since been rejected)
First seen: July 2026
Affected product: CVE program / National Vulnerability Database (advisories filed against SQLite)
Affected platforms: All platforms
Affected versions: CVE-2026-51296, CVE-2026-51297, CVE-2026-51300, CVE-2026-51302, CVE-2026-51303, CVE-2026-51304, all nominally filed against SQLite 3.41.0, with some advisories also naming 3.51.2 and 3.51.3. Part of a wider batch of 54 fabricated CVEs from a single submitter.
Links:
- https://github.com/advisories/GHSA-vrg3-8p22-cwh8 (example of vulnerability published 27 July 2026, last updated 28 July 2026 — still listed as Unreviewed at time of writing)
- https://access.redhat.com/security/cve/cve-2026-51302
- https://research.jfrog.com/post/sqlite-critical-cves-or-llm-slops/ (30 July 2026)
- https://lwn.net/Articles/1086936/ (3 August 2026)
- https://news.ycombinator.com/item?id=49154332 (August 2026)
- https://www.theregister.com/security/2026/08/03/ai-slop-pollutes-the-cve-pipeline-with-fake-vulns/5282462 (3 August 2026)