Bogus SQLite CVEs Expose Vulnerability-Pipeline Gaps
JFrog researchers reported on July 30 that six high- and critical-severity SQLite CVE advisories were technically invalid after source review and reproduction attempts. The Register reported that the advisories entered the National Vulnerability Database with CISA-supplied enrichment before JFrog found nonexistent functions, unrelated source references and non-working proof-of-concept payloads. MITRE later rejected the repository's submissions, according to an OSS-Security post cited by The Register.
JFrog researchers reported on July 30 that six purported SQLite vulnerabilities, assigned CVSS scores from 7.5 to 9.8, could not be substantiated through source review and proof-of-concept testing. The Register reports that the entries appeared in the National Vulnerability Database (NVD) with CISA-supplied enrichment, exposing a case in which high-severity CVE metadata propagated before the underlying technical claims were validated.
JFrog's research examined advisories published by a newly created GitHub repository. Its researchers cloned SQLite's official source repository, checked the cited versions, and tested the supplied payloads in an isolated workflow. According to the JFrog report, the advisories referenced functions that did not exist in the affected versions, cited unrelated code, or described fixes that were not present. The supplied proof-of-concept payloads did not trigger crashes.
One entry, CVE-2026-51302, alleged a use-after-free flaw in exprComputeOperands() and carried a 9.8 critical score. JFrog documented that the named function did not exist in the cited SQLite version. The Register reports that Red Hat initially assigned the issue a 10.0 CVSS score before lowering it to 7.6. Another entry, CVE-2026-51300, cited source lines unrelated to its alleged use-after-free issue, according to JFrog.
A broader batch of questionable submissions
The six SQLite entries were part of a repository containing more than 50 CVE-related advisories, according to JFrog. The remaining reports named libraw and ESP32-audioI2S as affected projects. JFrog did not test those reports to the same extent, but its report characterized all but one as likely invalid; the exception contained a real bug alongside unverified CVE metadata.
The Register cited an August 2 OSS-Security mailing-list post by Oracle Solaris engineer Alan Coopersmith stating that MITRE had rejected the repository's submissions. Coopersmith wrote that CVE Numbering Authorities (CNAs) that do not produce the affected code commonly rely on requesters to have verified submitted information.
Validation burden for security teams
This incident does not establish that every AI-assisted vulnerability report is false. It does show that CVSS severity, an NVD listing, and enrichment metadata are not substitutes for reproduction and source-level validation. In comparable software supply-chain workflows, automated ingestion of vulnerability feeds can turn an unverified report into urgent patching, triage, and compliance work.
For teams operating vulnerability-management pipelines, the practical distinction is between a CVE as an identifier and a confirmed exploitable defect. Reproducible proof-of-concept behavior, affected-version checks, upstream maintainer confirmation, and patch or commit analysis remain useful validation gates before elevating an alert to production remediation priority.
Key Points
- 1JFrog found six SQLite CVE claims unreproducible, showing that severe CVSS ratings and NVD presence do not independently validate a vulnerability.
- 2MITRE reportedly rejected the repository's submissions, but the entries had already created downstream enrichment and triage exposure across security workflows.
- 3Comparable vulnerability-management pipelines benefit from reproducibility, version verification, and upstream confirmation gates before urgent remediation decisions are made.
Scoring Rationale
The false SQLite CVEs reached the NVD and carried high or critical severity scores, creating a notable integrity risk for vulnerability-management automation and the security teams that ingest CVE feeds into prioritization, compliance or patching workflows.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
