54 Fake CVEs in Four Days, and Nobody Checked

Six of the fake advisories claimed critical use-after-free bugs in SQLite. They got real CVE IDs and real severity scores anyway. JFrog’s writeup, published on 30 July by researcher Afek Berger, walks through why each one falls apart on contact.

One advisory pins a use-after-free on a function absent from the version it names. Another cites source lines with nothing to do with the described bug. The proof-of-concept for a third runs a perfectly valid query and leaks no memory. Berger ran the combined text through GPTZero, which flagged it as AI-generated.

How 54 Fabricated Advisories Got CVE IDs

The CVE program runs on numbering authorities, and most of them assign IDs for code they didn’t write. Oracle’s Alan Coopersmith put the problem plainly on the OSS-Security list, as quoted by The Register: MITRE and most other CNAs assigning CVEs for third-party code “operate on the honor system.” The process demands no reproduction, no commit hash, no maintainer acknowledgement.

MITRE has now rejected the whole batch. That happened after the advisories had already been scored, enriched and propagated. Whether the matching GitHub Security Advisory and NVD entries have actually been retracted is unconfirmed; JFrog says it notified GHSA, Red Hat and NVD, and no follow-up has surfaced. The repo appeared to still be live at the time of writing, carrying 93 commits.

Berger’s line on cost is the one worth keeping: generative AI “has lowered the effort required to produce an advisory to close to zero.”

Junk CVEs Predate the Chatbots

Blaming this on AI is half right, and the wrong half matters. In September 2023, ThreatDown documented curl’s CVE-2020-19909, a disputed non-vulnerability filed from a years-old bug, with curl maintainer Daniel Stenberg saying NVD’s review was “not trying very hard.” The same piece covers Dan Lorenc’s finding of roughly 138 CVEs against open-source projects that looked bot-filed from scraped issues and commits, with maintainers left out entirely. That was 1,049 days ago, well before any of this became fashionable.

The honor-system gap Coopersmith describes is the same gap those 138 went through. AI found a hole that was already open, and made walking through it free.

There’s a second complication. On the Hacker News thread, one commenter named the tension:

“The problem with this kind of thing, is that it reduces the S/N (Signal-to-Noise) ratio, so weeding out the legit CVEs becomes a lot more difficult. But, on the other hand, I do know that LLMs have been discovering a lot of legit CVEs, and I will lay odds that the blackhats are leveraging them to the max.”

Models really are finding real bugs, and JFrog’s own zero-days were the ones OpenAI’s models used to hack Hugging Face six days ago. A rule filtering out AI-assisted submissions wholesale would cut real findings alongside the fabricated ones. The filter that separates the two is reproduction, and only reproduction.

The Review Backstop Is Already Underwater

A fake advisory sails through because the manual check behind it stopped functioning at scale. A Commerce OIG evaluation issued on 26 May found NIST’s NVD backlog grew from about 13,000 unprocessed vulnerabilities in June 2024 to more than 27,000 by the end of 2025, per CyberScoop’s reporting, with no strategic plan to clear it. The same report found NVD severity scores matched independent evaluators 12% of the time.

Legitimate volume climbs just as fast. The Linux kernel team published 432 CVEs in about 31 hours across 19 and 20 July. Akamai’s Jan Schaumann told The Register that prioritising individual changes at that rate isn’t feasible. The EU has meanwhile built its own bug database as US tracking wobbles, splitting the picture across two systems.

Generation cost near zero, review capacity falling, severity scores wrong 88% of the time. No amount of AI-detection tooling closes that gap.

Vetting a CVE Before You Chase It

JFrog’s checklist works today, whatever the CVE program eventually does about verification. Before treating a new advisory as real:

• Look for corroboration from the vendor or maintainer, not only the reporter.
• Check the references for a commit hash or pull request that fixes something.
• Read the CPE metadata for affected versions that make sense.
• Confirm the cited functions and line numbers exist in the named version.
• Run the proof-of-concept and watch it fail.

Any one of those would have caught all 54.

Motive is still guesswork. Berger speculates at padding a research CV, or poisoning automated CVE-flagging tools that ingest advisories without checking them. The second would be the more interesting outcome, and neither is confirmed.

Sources: SQLite Critical CVEs or LLM Slop? (JFrog Research) • Evaluation of NIST’s Management of the NVD (Commerce OIG) • The mystery of the CVEs that are not vulnerabilities (ThreatDown)

Coverage: AI slop pollutes the CVE pipeline with fake vulns (The Register) • US government report slams NIST for NVD backlog (CyberScoop) • Hacker News discussion

Related on this blog: JADEPUFFER’s 19-Day Upgrade: Ransomware Built to Destroy AI Models • One Word Beat GitHub’s Guardrail, and the Word Was ‘Additionally’ • Two Cowork Security Reports, Two Acknowledgements, No Fix