JFrog finds 54 of 55 SQLite CVEs were fabricated

JFrog's security team pulled a batch of 55 recently filed SQLite vulnerabilities and found that 54 of them were fabricated. Only one described a real bug. The reports have the surface texture of genuine advisories, including CVSS scores up to 9.8 and specific line numbers, but the details fall apart on inspection. One critical CVE pointed to a function, exprComputeOperands(), that does not exist in the SQLite version it claimed to affect. Another cited a fix in version 3.51.3 that never happened. A third referenced lines 3555 to 3575 in a file that is only 2,706 lines long.

To be sure, JFrog compiled the affected SQLite releases in isolated containers and ran each proof-of-concept payload under AddressSanitizer. Nothing crashed, because the bugs are not there. The researchers argue this is a structural weakness, not bad luck: anyone can submit a CVE without identity checks, and since early 2024 NIST has scaled back the deep analysis that once caught this kind of thing. Fabricated advisories then flow downstream into vulnerability databases and enterprise scanners, where they look real.

The plausible reading is that a language model generated these reports, either to pad a security researcher's record or as automated noise. The full write-up is on the JFrog research blog. It reads less like a one-off and more like a preview of what open vulnerability feeds look like when generation is free and verification is not.

Why it matters

If you run vulnerability scanners or triage CVEs, you are about to spend real hours chasing bugs that do not exist. The practical defense is the one JFrog used: demand a working proof of concept before you treat an advisory as real, and weight vendor-confirmed reports over raw CVE feeds.