Recent developments indicate that AI technology is contributing to the creation of fake vulnerabilities, which are contaminating the Common Vulnerabilities and Exposures (CVE) pipeline. A report from JFrog has identified a series of purported vulnerabilities in SQLite that were deemed technically invalid, highlighting significant flaws in the current CVE processing system.
Identifying the Issue
Last week, a batch of six SQLite vulnerabilities was published, claiming critical and high severity ratings. However, JFrog’s analysis revealed that these vulnerabilities were fabricated. The vulnerabilities, which had CVSS scores ranging from 9.8 to 7.5, did not describe any reproducible issues. For instance, one reported use-after-free vulnerability was based on a function that did not exist in the version of SQLite in question.
Scope of the Problem
In addition to the SQLite vulnerabilities, the same GitHub repository contained 49 other CVEs, allegedly affecting the libraw and ESP32-audioI2S libraries. While JFrog did not conduct extensive testing on these, it suggested that they were likely as fraudulent as the SQLite entries, except for one that contained a legitimate bug.
Impact on the CVE Pipeline
The incident underscores a systemic issue within the CVE pipeline, particularly as the US National Institute of Standards and Technology (NIST) struggles with a backlog of unprocessed vulnerabilities. As of late 2025, this backlog had exceeded 27,000 records, exacerbated by operational challenges and a surge in submissions. The absence of a mandatory verification process means that unsubstantiated reports can easily enter the system.
Recommendations for Security Professionals
JFrog has advised security professionals to exercise caution when evaluating newly published CVEs. Key indicators of potential fraud include a lack of vendor corroboration, missing commit hashes, and discrepancies in code references. The report has been communicated to the GitHub Security Advisory team, Red Hat, and NVD, leading to the removal or flagging of the invalid CVEs, although GitHub has not yet acted on the repository itself.
This situation illustrates the challenges posed by AI in the realm of cybersecurity, as the ease of generating plausible vulnerability reports contrasts sharply with the effort required to validate them. As the industry adapts to these developments, vigilance and thorough verification processes will be essential.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
