{"id":"CVE-2026-51298","aliases":["BIT-sqlite-2026-51298","EUVD-2026-49353","GHSA-c8x7-qp4j-858w","RHSA-2026:45779","UBUNTU-CVE-2026-51298"],"status":"rejected","title":"sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing...","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-416"],"published":"2026-07-27T00:00:00Z","modified":"2026-10-20T10:09:35Z","affected":[{"source":"osv","ecosystem":"Bitnami","package":"sqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"3.41.0"},{"last_affected":"3.41.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"lemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.53.4-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.53.4-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.53.4-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.53.4-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.53.4-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.53.4-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.53.4-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-tcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.53.4-0.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"sqlite-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.53.4-0.1.hum1"}]}],"bundled":6}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51298","tags":["web","advisory"]},{"url":"https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51298","tags":["web","advisory","article"]},{"url":"https://github.com/sqlite/sqlite/blob/master/src/json.c","tags":["web","article"]},{"url":"https://github.com/advisories/GHSA-c8x7-qp4j-858w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/51xxx/CVE-2026-51298.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:45779","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11824","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11822","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-51298","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-51304","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-51297","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-51302","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_45779.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11822","tags":["advisory"]},{"url":"https://sqlite.org/releaselog/3_53_2.html","tags":["article"]},{"url":"https://sqlite.org/src/info/061febcf41ca","tags":["article"]},{"url":"https://sqlite.org/src/info/4a5ad516ea93","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487269","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11824","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-51297","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507556","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-51298","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-51302","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-51304","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-51298","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-51298","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2026-07-27T00:00:00Z","modified":"2026-07-31T14:34:34.844Z","updated_at":"2026-11-02T13:39:50.160666Z"}],"euvd":[{"id":"EUVD-2026-49353","description":"DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-07-31T14:34:34Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:02:25.856077Z"}],"ghsa":[{"id":"GHSA-c8x7-qp4j-858w","title":"sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing...","description":"sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.","status":"published","published":"2026-07-27T18:31:47Z","modified":"2026-07-27T21:31:21Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:09:51.407039Z"}],"nvd":[{"id":"CVE-2026-51298","description":"Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2026-07-27T16:17:39.047Z","modified":"2026-07-31T15:17:11.813Z","updated_at":"2026-11-02T14:12:33.249634Z"}],"osv":[{"id":"CVE-2026-51298","description":"sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-07-31T03:49:45.815754408Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"RHSA-2026:45779","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-30T10:17:20Z","modified":"2026-10-20T10:09:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-51298","description":"Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"withdrawn","published":"2026-07-27T16:17:00Z","modified":"2026-08-06T22:15:14.533865315Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"BIT-sqlite-2026-51298","description":"sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.","status":"published","published":"2026-07-30T08:53:33.123Z","modified":"2026-07-30T09:15:15.642456361Z","updated_at":"2026-11-02T15:28:35.111822Z"}]}}