SQLite's Official Vulnerability Page Brands Six 'Critical' CVEs as AI Hallucinations After NVD Rejects Them
SQLite's own CVE tracker and the National Vulnerability Database both rejected six reports as AI-hallucinated after a JFrog researcher found the underlying code and PoCs didn't exist or didn't work.
Editor's Note ·
- Correction:
- The article states the CVE-2026-51302 NVD record was 'modified two days later by CISA's Authorized Data Publisher (ADP) program, which added a CVSS 3.1 score' after being received from MITRE on July 27, 2026. NVD's own change history shows the ADP's CVSS 3.1 addition actually occurred on July 28, 2026 — one day later, not two.
- Correction:
- The article quotes the GitHub repository (extratao/CVE-2026-51302-PoC) as saying the advisory's function "didn't exist until June 30, 2025 — over two years after SQLite 3.41's release." The repository does not contain this sentence verbatim; it appears as two separate bullet points reading "exprComputeOperands() does not exist in SQLite 3.41.0, 3.41.1 or 3.41.2" and "that function was introduced on 30 June 2025, more than two years after SQLite 3.41." The underlying fact is accurate, but the quoted sentence was synthesized from two distinct statements rather than reproduced verbatim.
Overview
Six vulnerability reports filed against the SQLite database engine have been formally rejected as fabrications after investigators concluded they were generated by an AI system rather than by real security research. SQLite’s official vulnerabilities page now lists CVE-2026-51296, CVE-2026-51297, CVE-2026-51300, CVE-2026-51302, CVE-2026-51303, and CVE-2026-51304 together under the verdict “Not a bug in SQLite,” with a comment reading: “These are unreproducible. They appear to be AI hallucinations. See the analysis at JFrog.com.”
What We Know
The six records were originally published as critical-severity advisories via GitHub. According to JFrog’s security research blog, researcher Afek Berger examined the advisories and found that the code they cited “didn’t even exist in those versions or referenced unrelated logic,” and that when the accompanying proof-of-concept payloads were tested, they “didn’t work (not triggering any crash).” None of the six appeared on SQLite’s own advisory tracking page at the time. When JFrog combined the six advisories into a single file and ran the text through the AI-detection tool GPTZero, the test produced “AI-generated content warnings,” according to JFrog.
JFrog also pointed to a structural weakness that let the reports advance as far as they did: the CVE submission process through MITRE’s public form “lacks any real identity verification, meaning virtually anyone can submit a vulnerability description,” according to JFrog.
The National Vulnerability Database independently marked at least two of the six records — CVE-2026-51297 and CVE-2026-51302 — as “Rejected,” with each carrying the same withdrawal note: “This record was withdrawn by its CNA. Further investigation showed that it was not a security issue.” For CVE-2026-51302 specifically, NVD’s record shows the report was received from MITRE on July 27, 2026, then modified two days later by CISA’s Authorized Data Publisher (ADP) program, which added a CVSS 3.1 score, before MITRE rejected the record outright on July 31, 2026, stripping its metrics, references, and affected-systems data.
An independent researcher separately disputed CVE-2026-51302 in a public GitHub repository titled “CVE-2026-51302: Technical Inconsistencies,” whose description reads: “Clickbait. The CVE is AI slop.” The repository’s author wrote that “this CVE is complete and utter LLM hallucinated slop, honestly sad to see a CNA accept this with how inconsistent the claims are,” and noted that the function the advisory centered on, exprComputeOperands(), “didn’t exist until June 30, 2025 — over two years after SQLite 3.41’s release.” The author said they intended to “raise a CNA dispute with MITRE” over the record.
As previously reported by The Machine Herald, seven AI companies — including Anthropic, Google, and OpenAI — pledged $12.5 million in March 2026 to help open source maintainers cope with a flood of AI-generated vulnerability reports, after projects including curl shut down bug bounty programs over the same problem. That funding was aimed at reports overwhelming maintainer inboxes. The SQLite case shows AI-generated reports reaching further: past a CVE Numbering Authority and into scored entries in the federal government’s own vulnerability database before being caught.
What We Don’t Know
JFrog’s analysis does not identify which specific AI tool or model produced the six advisories, only that GPTZero flagged the combined text as AI-generated. It is not established whether a single submitter is behind all six records, and it remains unclear how many other unreproduced or rejected CVE records elsewhere in the National Vulnerability Database may share a similar AI-generated origin.
Analysis
The episode illustrates a gap between the volume of vulnerability submissions flowing into MITRE’s CVE process and the verification applied before those submissions reach official databases. A CVE record advanced far enough to receive a CISA-assigned CVSS score before anyone tested whether the underlying code even existed in the affected software version — a step that, in this case, took an outside security research team rather than the assignment pipeline itself to catch.