The Verification Gap: When CVEs Become a Signal-to-Noise Problem
The Verification Gap
In late July 2026, a brand-new GitHub account called programmervuln/cveadvisory- published over 50 vulnerability advisories. Six of them targeted SQLite; NVD quickly tagged them as Critical and High severity, CISA’s ADP enriched them, and Red Hat assigned one a 10.0 CVSS score. Every single one was fabricated. JFrog’s security researchers, cloning the official SQLite source and running the “proof-of-concept” SQL under AddressSanitizer, found that the cited functions didn’t exist in the target versions, the referenced line numbers pointed to comments and allocation calls rather than any vulnerability, and the PoC payloads didn’t crash anything. MITRE has since rejected the entire batch. The advisories were, almost certainly, LLM-generated slop — 54 of the 55 from that account appear fabricated, and the one real bug had unverifiable metadata.
What makes this episode significant isn’t the fabrication itself — hoax CVEs are as old as the database — but how far the fake reports travelled before anyone checked them. They passed through NVD severity scoring, CISA enrichment, and Red Hat’s triage before a single researcher actually compiled the code. The CVE pipeline, designed to be a trust-minimisation layer between discoverers and defenders, has quietly become a signal-amplification layer that operates largely on submitter honesty. As CVE Numbering Authorities lack the resources to independently verify every report, a new account can publish authoritative-looking advisories and trigger real operational consequences — patches, tickets, alerts — across the ecosystem on the strength of formatting alone.
This is the downstream pressure point of a structural mismatch the cybersecurity community has been warning about for over a year. NIST reports CVE submissions grew 263% between 2020 and 2025; it enriched nearly 42,000 CVEs in 2025, and first-quarter 2026 volume was already running a third higher year-on-year. GitHub’s senior security manager, Madison Ficorilli, said reports received over the past 90 days were 224% higher than the previous 90 days — “like nothing I have personally seen before.” Meanwhile, NIST quietly reclassified its entire pre-March 2026 enrichment backlog as “Not Scheduled,” effectively conceding it can’t catch up. CVE Program board member Katie Noble put it bluntly at RSAC 2026: “We are still trying to build a better horse, and the community is launching spaceships to Mars.” Verification capacity is flat or shrinking while inflow compounds — and LLM-generated reports, whether earnest-but-wrong or deliberately fabricated, exploit exactly that ratio.
The deeper risk is the recursion. As LWN’s Jonathan Corbet noted, in environments where AI is used to automate triage and remediation, a fabricated CVE becomes an instruction: an agent may “attempt to locate the vulnerable function, generate a patch, or recommend changes based on code that does not even exist.” The slop doesn’t just waste human time — it generates more slop downstream, as autonomous patching agents confidently rewrite code to fix hallucinated use-after-frees. The CVE pipeline was built to reduce uncertainty; AI-generated reports, amplified by AI-driven remediation, can manufacture it. This is a genuine adversarial pattern, not a hypothetical one: fabricate the vulnerability, let an agent “fix” it, and the attacker gets a free code-modification primitive delivered through the legitimate supply chain.
The structural fix isn’t obvious. Verification can’t scale linearly with submission volume; the only durable answer is a reputation-weighted trust model where new reporters face friction that established CNAs don’t — the inverse of today’s system, where a brand-new account’s advisories flow through the same pipeline as SQLite’s own. The CVE Program’s value, as Noble emphasised, is entirely community buy-in: “It’s just a contract.” A pipeline that can’t distinguish a real 9.8 Critical from a hallucinated one will lose that buy-in, and with it the foundation that all downstream defence operations rely on.
Sources
- SQLite Critical CVEs or LLM Slop? — JFrog Security Research
- AI slop pollutes the CVE pipeline with fake vulns — The Register
- MITRE Rejects Fabricated SQLite CVEs Tied to Suspect AI-Generated Reports — Mallory
- The CVE Program, a bedrock of global cyber defense, is teetering on the brink — Cybersecurity Dive
- SQLite Critical CVEs or LLM Slop? (JFrog blog) — LWN.net
- The Bugpocalypse: Rebuilding Vulnerability Management After NVD and Mythos — Quzara
- SQLite Critical CVEs or LLM Slop? — HN discussion