Loading vulnerability…
Rejected SQLite ORDER BY use-after-free claim
CVE-2026-51304 is a rejected CVE record withdrawn by its CNA after investigation determined that it did not represent a security issue. The original allegation described a SQLite use-after-free involving access to pOrderBy->nExpr after sqlite3ExprListDelete(). However, the alleged code used an incorrect single-argument function signature, and SQLite clears the pOrderBy pointer immediately after deletion, preventing the claimed dereference. The associated proof of concept executed normally and returned sorted results without reproducing the alleged vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
No security impact is established. Claims of denial of service, memory disclosure, and arbitrary code execution were not substantiated, and the CVE record was rejected.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is warranted because the alleged security issue was not validated and the CVE was rejected.
Patch, then assume compromise.
No security patch or SQLite upgrade is required specifically for this rejected CVE. Remove or suppress vulnerability findings based solely on CVE-2026-51304 and update vulnerability-management records to reflect its rejected status.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.