Copyright © 2012 Red Hat, Inc. All rights reserved. 2026-07-27T00:00:00 sqlite: SQLite: Use-after-free vulnerability leads to denial of service and information disclosure CWE-825

A flaw was found in SQLite. A use-after-free vulnerability in the SQLite JSON module's jsonRemoveFunc allows a remote attacker to cause a denial of service by crashing the service. This vulnerability can also lead to the disclosure of sensitive heap memory information.

Red Hat Product Security has evaluated CVE-2026-51296, which claims a Use-After-Free vulnerability in SQLite. After conducting independent analysis of the affected SQLite versions, Red Hat has determined that this vulnerability does not affect our products. SQLite upstream have confirmed this CVE as fictitious (https://sqlite.org/forum/forumpost/e2b966c8fc). This CVE has been marked as Rejected by the assigning CNA. Red Hat Enterprise Linux 10 Not affected sqlite Red Hat Enterprise Linux 6 Not affected sqlite Red Hat Enterprise Linux 7 Not affected sqlite Red Hat Enterprise Linux 8 Not affected mingw-sqlite Red Hat Enterprise Linux 8 Not affected nodejs:22/nodejs Red Hat Enterprise Linux 8 Not affected nodejs:24/nodejs Red Hat Enterprise Linux 8 Not affected rust-toolset:rhel8/rust Red Hat Enterprise Linux 8 Not affected sqlite Red Hat Enterprise Linux 9 Not affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Not affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Not affected rust Red Hat Enterprise Linux 9 Not affected sqlite Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rust Red Hat Hardened Images Not affected sqlite Red Hat OpenShift Container Platform 4 Not affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-51296 https://nvd.nist.gov/vuln/detail/CVE-2026-51296 https://github.com/programmervuln/cveadvisory-/commit/75a435c839a4bcc6ca2ad21e3b07c978d814acb2 https://github.com/sqlite/sqlite/blob/master/src/json.c https://sqlite.org/forum/forumpost/e2b966c8fc