CVE-2026-51298
sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing...
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-c8x7-qp4j-858w
sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing...
sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.
- Record
GHSA-c8x7-qp4j-858w- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
CVE-2026-51298- Updated
- 2026-11-02
EUVDEUVD-2026-49353
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
EUVD-2026-49353- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD No score
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
CVE-2026-51298- Updated
- 2026-11-02
OSV
sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.
- Record
CVE-2026-51298- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:45779
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:45779- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-51298
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
- Record
UBUNTU-CVE-2026-51298- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-sqlite-2026-51298 No score
sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.
- Record
BIT-sqlite-2026-51298- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sqliteBitnami |
3.41.0 to 3.41.0 | None known |
lemonRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.53.4-0.1.hum1 | 0:3.53.4-0.1.hum1 |
sqliteRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.53.4-0.1.hum1 | 0:3.53.4-0.1.hum1 |
sqlite-analyzerRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.53.4-0.1.hum1 | 0:3.53.4-0.1.hum1 |
sqlite-debugRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.53.4-0.1.hum1 | 0:3.53.4-0.1.hum1 |
sqlite-develRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.53.4-0.1.hum1 | 0:3.53.4-0.1.hum1 |
sqlite-docRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.53.4-0.1.hum1 | 0:3.53.4-0.1.hum1 |
sqlite-libsRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.53.4-0.1.hum1 | 0:3.53.4-0.1.hum1 |
sqlite-tclRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.53.4-0.1.hum1 | 0:3.53.4-0.1.hum1 |
sqlite-toolsRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.53.4-0.1.hum1 | 0:3.53.4-0.1.hum1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-51298 has been rejected by its source and should not be treated as a live vulnerability, published July 27, 2026.
References
nvd.nist.gov/vuln/detail/CVE-2026-51298
github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51298
access.redhat.com/errata/RHSA-2026:45779
Show 26 moreShow less
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45779.json
bugzilla.redhat.com/show_bug.cgi?id=2487258
cve.org/CVERecord?id=CVE-2026-11822
sqlite.org/releaselog/3_53_2.html
vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension
ubuntu.com/security/CVE-2026-51298