Critical CVE issued for hallucinated SQLite vulnerability

JFrog security researchers said Monday they found that a batch of critical SQLite vulnerability advisories published to GitHub and flagged by the National Vulnerability Database and CISA were fabricated. The advisories originated from a newly created GitHub repository, programmervuln/cveadvisory-, which published more than 50 CVEs. NVD initially flagged the SQLite entries as critical and CISA's Authorized Data Publisher agreed. JFrog researchers verified the claims by cloning the official SQLite repository, building isolated Docker containers and testing proof-of-concept payloads under AddressSanitizer instrumentation. They found cited functions did not exist in the targeted versions, referenced line numbers were incorrect and proof-of-concept queries either failed at the parser stage or executed without errors. One advisory claimed a heap use-after-free in sqlite3ReleaseTempReg, but the function recycles register indices and does not deallocate memory. Another cited a function, exprComputeOperands, that was added in mid-2025, months after the targeted SQLite 3.41.0 release. Red Hat initially assigned CVE-2026-51302 a 10.0 Critical severity score before downgrading it to 7.6 High. A broader audit of 55 advisories from the same GitHub account revealed 54 were completely fabricated. JFrog said the CVE submission process via MITRE's public form lacks identity verification and that NIST paused deep analysis in February 2024 due to a surge in reports.