Loading vulnerability…
Rejected SQLite JSON use-after-free claim
CVE-2026-51297 was withdrawn by its assigning CNA after further investigation determined that it was not a security issue. The record alleged a use-after-free involving SQLite's jsonBlobEdit() function in version 3.41.0, but that function was absent from the claimed affected version and was introduced later with JSONB support. The associated proof of concept failed with a malformed JSON error before reaching the alleged vulnerable logic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
No security impact has been established. The alleged use-after-free was not substantiated, and claims of arbitrary code execution, information disclosure, or denial of service are unsupported.
If you can’t patch tonight, do this now.
Until a fixed version is deployed, reduce exposure by preventing untrusted or externally supplied JSON from reaching vulnerable SQLite JSON functionality where feasible. Constrain the privileges of applications using SQLite, isolate exposed services, and apply exploit-mitigation controls provided by the platform to reduce the likelihood and impact of memory-corruption exploitation.
Patch, then assume compromise.
No vulnerability-specific patch or upgrade is required for this rejected record. Remove or mark findings based solely on CVE-2026-51297 as rejected rather than treating SQLite 3.41.0 as vulnerable on that basis.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.