CVE-2026-51296
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The...
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-5hvg-wjm2-j333
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The...
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information.
- Record
GHSA-5hvg-wjm2-j333- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
CVE-2026-51296- Updated
- 2026-11-02
EUVDEUVD-2026-49351
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
EUVD-2026-49351- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD No score
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
CVE-2026-51296- Updated
- 2026-11-02
OSV
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information.
- Record
CVE-2026-51296- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-51296
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
UBUNTU-CVE-2026-51296- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-sqlite-2026-51296 No score
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information.
- Record
BIT-sqlite-2026-51296- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sqliteBitnami |
3.41.0 to 3.41.0 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-51296 has been rejected by its source and should not be treated as a live vulnerability, published July 27, 2026.
References
nvd.nist.gov/vuln/detail/CVE-2026-51296
github.com/programmervuln/cveadvisory-/commit/75a435c839a4bcc6ca2ad21e3b07c978d814acb2
ubuntu.com/security/CVE-2026-51296
cve.org/CVERecord?id=CVE-2026-51296