MITRE Rejects Fabricated SQLite CVEs Tied to Suspect AI-Generated Reports

MITRE rejected a batch of CVE reports affecting SQLite, libraw, and ESP32-audioI2S after researchers found the underlying claims were likely fabricated. An oss-sec post cited JFrog's review of recently published SQLite advisories and said some records had briefly appeared on cve.org before being withdrawn, underscoring how CVE Numbering Authorities often depend on submitter accuracy and may not be able to independently validate every report before publication.

JFrog said six SQLite entries—CVE-2026-51302, CVE-2026-51303, CVE-2026-51300, CVE-2026-51297, CVE-2026-51296, and CVE-2026-51304—contained major inconsistencies, including references to nonexistent functions, invalid SQL, impossible code paths, mismatched line numbers, and proof-of-concept payloads that did not reproduce crashes. The researchers traced the advisories to a newly created GitHub repository and concluded they were largely AI-generated "LLM slop"; in a broader audit of 55 advisories from the same account, they found 54 appeared fabricated and one described a real bug but with unverified CVE metadata, raising concerns that false high-severity entries can pollute NVD and CISA enrichment pipelines and mislead automated vulnerability triage.