JFrog Finds 54 of 55 SQLite Advisories Were Fabricated

JFrog tested six SQLite CVEs published as critical and found all six fabricated. The advisories cite functions that do not exist in the versions they name, reference line numbers past the end of the source files, and ship proof-of-concept payloads that produce no crash under AddressSanitizer. None appeared on SQLite’s own advisory page. Widening the check, JFrog assessed 54 of 55 advisories from the same account as fake. The structural cause is older than the generator: NIST reduced manual analysis of submissions in February 2024, so nothing in the path between submission and publication attempts to reproduce the claimed bug.