CVE-2026-51297

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "REJECTED", "cveId": "CVE-2026-51297", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-07-31T14:34:34.058Z", "dateRejected": "2026-07-31T00:00:00.000Z", "dateReserved": "2026-06-07T00:00:00.000Z", "datePublished": "2026-07-27T00:00:00.000Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-31T14:34:34.058Z"}}}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "REJECTED", "cveId": "CVE-2026-51297", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-07-31T14:34:34.058Z", "dateRejected": "2026-07-31T00:00:00.000Z", "dateReserved": "2026-06-07T00:00:00.000Z", "datePublished": "2026-07-27T00:00:00.000Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-07-31T14:34:34.058Z"}}}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."}], "id": "CVE-2026-51297", "lastModified": "2026-07-31T15:16:55.740", "metrics": {}, "published": "2026-07-27T16:17:38.933", "references": [], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "sqlite: sqlite: Arbitrary code execution via use-after-free in JSON parsing", "id": "2507548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507548"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in sqlite. This use-after-free vulnerability in the JSON parsing logic allows remote attackers to craft malicious JSON payloads. This can trigger memory deallocation followed by illegal memory access, potentially leading to arbitrary code execution, sensitive information leakage, or denial of service."], "name": "CVE-2026-51297", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "impact": "critical", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "impact": "critical", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "impact": "critical", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "impact": "critical", "package_name": "mingw-sqlite", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "impact": "critical", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "impact": "critical", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "impact": "critical", "package_name": "rust-toolset:rhel8/rust", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "impact": "critical", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "impact": "critical", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "impact": "critical", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "impact": "critical", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "impact": "critical", "package_name": "sqlite", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "impact": "critical", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "critical", "package_name": "sqlite", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "impact": "critical", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-07-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-51297\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-51297\nhttps://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51297\nhttps://github.com/sqlite/sqlite/blob/master/src/json.c"], "statement": "This Important use-after-free flaw in sqlite's JSON parsing logic allows remote attackers to potentially achieve arbitrary code execution, information disclosure, or denial of service. The vulnerability can be triggered without user interaction by processing specially crafted JSON payloads in applications that utilize sqlite for JSON operations.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.41"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "sqlite", "vendor": "sqlite"}], "created": "2026-07-27T16:30:16.428825+00:00", "title": "SQLite 3.41 Use-After-Free in JSON Parsing Enables Remote Code Execution", "updated": "2026-07-28T15:30:04.996842+00:00", "vendors": ["sqlite", "sqlite$PRODUCT$sqlite"], "weaknesses": ["CWE-416"]}