Critical CVE issued for hallucinated SQLite vulnerability
Points and comments are a snapshot, not live.
JFrog researchers found 54 of 55 SQLite CVEs from one repo were AI-fabricated and invalid.
A GitHub repo published a batch of SQLite vulnerability advisories, and NVD flagged them as critical. JFrog's investigation found that the cited code didn't exist in those versions, PoC payloads didn't trigger crashes, and none of the CVEs appear on SQLite's official advisory page. Testing with Gptzero suggested the advisories were AI-generated. For example, CVE-2026-51302 referenced the nonexistent function `exprComputeOperands()` in SQLite 3.41. The CVE submission process via MITRE's public form lacks identity verification, and NIST paused deep analysis in February 2024, allowing fabricated CVEs to enter downstream databases.
What commenters are saying
The dominant sentiment is concern that organizations mandated to patch all CVEs will waste resources on fake vulnerabilities, potentially causing real harm if used offensively. Commenters note that many orgs have policies requiring patching of critical CVEs within short timelines for compliance (SOC2, HIPAA, ISO27000), but exceptions are often possible. Some argue the system's signal-to-noise ratio was already poor and that LLMs are also finding real vulnerabilities, creating a cyber arms race. A few point out that agents could verify CVEs before human review, but that introduces cost and complexity.