A flaw was found in sqlite. A remote attacker can exploit a use-after-free vulnerability in the ORDER BY clause parsing routine by crafting a malicious SQL statement. This can lead to an application crash, sensitive information disclosure, and in some cases, arbitrary code execution, allowing the attacker to run their own commands on the affected system.

Red Hat Product Security has evaluated CVE-2026-51304, which claims a Use-After-Free vulnerability in SQLite. After conducting independent analysis of the affected SQLite versions, Red Hat has determined that this vulnerability does not affect our products. SQLite upstream have confirmed this CVE as fictitious (https://sqlite.org/forum/forumpost/e2b966c8fc). This CVE has been marked as Rejected by the assigning CNA. Red Hat Hardened Images 2026-07-25T00:00:00Z RHSA-2026:45779 sqlite-main-3.53.4-0.1.hum1 Red Hat Enterprise Linux 10 Not affected sqlite Red Hat Enterprise Linux 6 Not affected sqlite Red Hat Enterprise Linux 7 Not affected sqlite Red Hat Enterprise Linux 8 Not affected mingw-sqlite Red Hat Enterprise Linux 8 Not affected nodejs:22/nodejs Red Hat Enterprise Linux 8 Not affected nodejs:24/nodejs Red Hat Enterprise Linux 8 Not affected rust-toolset:rhel8/rust Red Hat Enterprise Linux 8 Not affected sqlite Red Hat Enterprise Linux 9 Not affected nodejs:22/nodejs Red Hat Enterprise Linux 9 Not affected nodejs:24/nodejs Red Hat Enterprise Linux 9 Not affected rust Red Hat Enterprise Linux 9 Not affected sqlite Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rust Red Hat OpenShift Container Platform 4 Not affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-51304 https://nvd.nist.gov/vuln/detail/CVE-2026-51304 https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51304 https://github.com/sqlite/sqlite/blob/master/src/expr.c https://sqlite.org/forum/forumpost/e2b966c8fc