Bug 2507902

Summary: CVE-2026-51298 sqlite: SQLite: Denial of Service via use-after-free in JSON extraction [fedora-all]
Product: [Fedora] Fedora Reporter: Vipul Nair <vinair>
Component: sqliteAssignee: Petr Khartskhaev <pkhartsk>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: db-sig, fjanus, ndavidov, pkhartsk, pkubat
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["5d1d98f8-87aa-4511-83a9-117bd89e30ad"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-07-28 13:13:58 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2507556    

Description Vipul Nair 2026-07-28 08:27:08 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program still accesses internal member of the freed pointer, which can cause service crash and denial of service.
Comment 1 Petr Khartskhaev 2026-07-28 13:13:58 UTC 
From what I see, this and CVE-2026-51296 are completely bogus reports, no idea how they ended up as CVEs.

1. the version 3.41 that they're reported against doesn't even have that code yet
2. they're both reported for the same chunk of code
3. that chunk of code is only on the lines specified in the reports (3555-3575) on the latest branch, so that's actually the version they meant to report against (3.53.4), but the code itself is basically unchanged from when it was introduced in 3.45.0
4. that chunk of code contains zero use after free errors as directly after each free in that function there is a return; 
5. I could not replicate w/ the reproducer given there is actually no error in the code
6. The source for both is some random repo on github https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51296 https://github.com/programmervuln/cveadvisory-/blob/main/CVE-2026-51298, no acknowledgement from upstream

Relevant code in 3.45.0:

```c
  JsonParse *p;
  JsonParse ax;

  assert( (argc&1)==1 );
  flgs = argc==1 ? 0 : JSON_EDITABLE;
  p = jsonParseFuncArg(ctx, argv[0], flgs);
  if( p==0 ) return;
  for(i=1; i<argc-1; i+=2){
    if( sqlite3_value_type(argv[i])==SQLITE_NULL ) continue;
    zPath = (const char*)sqlite3_value_text(argv[i]);
    if( zPath==0 ){
      sqlite3_result_error_nomem(ctx);
      jsonParseFree(p);
      return;
    }
    if( zPath[0]!='$' ) goto jsonInsertIntoBlob_patherror;
    if( jsonFunctionArgToBlob(ctx, argv[i+1], &ax) ){
      jsonParseReset(&ax);
      jsonParseFree(p);
      return;
    }
    if( zPath[1]==0 ){
      if( eEdit==JEDIT_REPL || eEdit==JEDIT_SET ){
        jsonBlobEdit(p, 0, p->nBlob, ax.aBlob, ax.nBlob);
      }
      rc = 0;
   }else{
      p->eEdit = eEdit;
      p->nIns = ax.nBlob;
      p->aIns = ax.aBlob;
      p->delta = 0;
      rc = jsonLookupStep(p, 0, zPath+1, 0);
    }
    jsonParseReset(&ax);
    if( rc==JSON_LOOKUP_NOTFOUND ) continue;
    if( JSON_LOOKUP_ISERROR(rc) ) goto jsonInsertIntoBlob_patherror;
  }
  jsonReturnParse(ctx, p);
  jsonParseFree(p);
  return;

jsonInsertIntoBlob_patherror:
  jsonParseFree(p);
  if( rc==JSON_LOOKUP_ERROR ){
    sqlite3_result_error(ctx, "malformed JSON", -1);
  }else{
    jsonBadPathError(ctx, zPath);
  }
  return;
```