SQLite Got a 9.8 CVE That Was Actually an AI‑Generated Fabrication

1. AI‑First Verification

D. Richard Hipp, the creator of SQLite, noted that on July 27, 2026, 27 security warnings for SQLite appeared in the CVE database, each assigned a severity rating by a U.S. government agency. Automated scanners immediately surfaced these alerts to patch engineers.

Hipp responded on July 29, stating that the reported CVEs were fabricated. He cited SUSE, which had submitted the reports to the AI model Claude, which flagged them as bogus.

2. Finally Someone Verified

JFrog’s security research team published a report on July 30, selecting six of the 27 CVEs for deep analysis. Analyst Afek Berger retrieved the exact source versions, built isolated containers, and executed each proof‑of‑concept (PoC) code.

All six PoCs ran without crashes or memory errors, proving the vulnerabilities did not exist. Specific results include:

CVE‑2026‑51300 : query executed successfully, no leaks or errors.

CVE‑2026‑51302 : query executed successfully, no crash because the vulnerability is nonexistent.

GitHub user extratao independently reproduced the same test on July 28, also finding no crash. He noted that the reported vulnerable function exprComputeOperands() was added on 2025‑06‑30, whereas the CVE claimed a bug in version 3.41.0 released in February 2023—two years earlier.

3. “AI Garbage”

Programmer programmervuln had previously submitted similar issues to the LibRaw project. One of those issues, initially reported as a severe heap overflow, was later renamed “AI garbage”. The same account later created two GitHub repositories ( vlmuaf and cveadvisory) that referenced “use‑after‑free” AI‑generated CVE content.

4. Anyone Can Submit

MITRE, the CVE Numbering Authority (CNA), assigns identifiers, while the U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds severity scores. The three SQLite CVEs received CVSS scores of 9.8, 8.8, and 7.5. LibRaw’s issue received an 8.8 score.

Because of a surge in submissions, NVD’s analysis slowed in early 2024, leaving many entries unverified.

5. The Account Is Still Active

The programmervuln account, created on January 29, 2026, has no public profile details. It pushed a repository on July 23, 2026 described as a “visual language model for mining use‑after‑free bugs”, matching the fabricated SQLite reports.

6. One Submission, 76 Revoked

On July 31, MITRE withdrew 76 CVE numbers (CVE‑2026‑51229 to CVE‑2026‑51304), including all 27 SQLite entries and the LibRaw issue. Fourteen of the SQLite reports never entered the public record and were rejected from a “reserved” state.

Oracle Solaris engineer Alan Coopersmith explained that CNAs lack funding and environments to verify reports, so they rely on submitters’ honesty.

7. These Vulnerabilities Are Fake

Hipp concluded that new SQLite CVEs can be assumed false. All six CVE IDs now appear on SQLite’s official vulnerability page under “non‑SQLite vulnerability” with a note that they are unreproducible and likely AI hallucinations, directing readers to JFrog’s analysis.

Despite the retractions, GitHub still lists the CVE‑2026‑51302 entry as severe, with a duplicate GHSA identifier, and has not removed it. JFrog reported the findings to GitHub, Red Hat, and NVD; Red Hat and NVD have marked the CVE as rejected, while GitHub remains unchanged.