Bug 2507916

Summary:	CVE-2026-51296 qt6-qtwebengine: SQLite: Use-after-free vulnerability leads to denial of service and information disclosure [epel-all]
Product:	[Fedora] Fedora EPEL	Reporter:	Vipul Nair <vinair>
Component:	qt6-qtwebengine	Assignee:	Troy Dawson <tdawson>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	epel10	CC:	jgrulich, kde-sig, tdawson
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["f0d17348-909d-4333-aa22-806ccd01261d"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2507546

Description Vipul Nair 2026-07-28 08:37:45 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information.