Researchers from JFrog recently conducted an analysis of 55 reports detailing vulnerabilities in SQLite. These reports led to the assignment of CVE identifiers by the MITER organization. Out of the identified vulnerabilities, three were classified as critical. The most severe vulnerability, labeled as CVE-2026-51302, was rated as a 10 out of 10 by Red Hat in its databases and 9.8 out of 10 by SUSE. However, upon closer examination, it was discovered that 54 out of the 55 reported vulnerabilities, including the critical issue, were found to be fictitious and were actually caused by the AI model’s hallucinations.
The most dangerous vulnerability involved a scenario where memory was accessed after it had been freed in the exprComputeOperands() function. This flaw could potentially lead to code execution when processing a specially crafted request. Further investigation revealed that the mentioned function did not even exist in the SQLite 3.41 codebase where the issue was reported, indicating a false alarm. The source of the vulnerability was attributed to leaving a dangling pointer in the sqlite3ReleaseTempReg() function, which does not involve memory freeing and only marks memory for reuse, eliminating any use-after-free problems.
Additional reported vulnerabilities also referenced non-existent files, functions, or lines of code without actual errors, leading to unsubstantiated claims. Exploit prototypes provided in the reports were found to be non-functional and did not result in crashes, despite claims of possible code execution through SQL queries.
It was noted that the MITER organization’s process for assigning CVE identifiers and assessing the severity of vulnerabilities lacks a thorough validation mechanism, allowing for fabricated descriptions to be submitted. These false reports clutter vulnerability databases, leading to wasted time and resources in attempting to address non-existent issues. Utilizing AI to develop patches based on inaccurate bug descriptions could result in unnecessary modifications.