CVE-2026-51296: SQL Injection

Published Jul 27, 2026

Updated

SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information.

Affected Software

1 affected component

SQLite SQLite JSON module=3.41

Event History

Jul 27, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-51296?

CVE-2026-51296 has a high severity rating of 7.5 according to the CVSS v3.1 scoring system.

How do I fix CVE-2026-51296?

To fix CVE-2026-51296, upgrade to the latest version of SQLite that addresses the use-after-free vulnerability.

What can attackers achieve by exploiting CVE-2026-51296?

Attackers can exploit CVE-2026-51296 to crash the service and potentially leak sensitive heap memory information.

In which component of SQLite does CVE-2026-51296 exist?

CVE-2026-51296 exists in the jsonRemoveFunc of the SQLite JSON module.

What type of vulnerability is CVE-2026-51296 classified as?

CVE-2026-51296 is classified as a use-after-free vulnerability.

CVE-2026-51296: SQL Injection

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-51296?

How do I fix CVE-2026-51296?

What can attackers achieve by exploiting CVE-2026-51296?

In which component of SQLite does CVE-2026-51296 exist?

What type of vulnerability is CVE-2026-51296 classified as?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-51296?

How do I fix CVE-2026-51296?

What can attackers achieve by exploiting CVE-2026-51296?

In which component of SQLite does CVE-2026-51296 exist?

What type of vulnerability is CVE-2026-51296 classified as?