AI Threat AlertCVE-2024-0232: SQLite: JSON parser use-after-free causes local DoS
MEDIUMCVE-2024-0232 is a heap use-after-free in SQLite's JSON parsing code (jsonParseAddNodeArray) that lets crafted JSON input crash the host application and cause a denial of service. It matters for AI teams because SQLite is embedded throughout the Red Hat OpenShift AI (RHOAI) container images listed as affected, including the dashboard, KServe controllers, MLflow, model registry and notebook controllers. That gives it a wide footprint, with 695 downstream dependents and 137 other tracked CVEs in the same package. Exploitation risk is low: the vector is local, complexity is high, user interaction is required, and the impact is availability only (CVSS 4.7). It is not in CISA KEV, no public exploit or Nuclei template exists, and no EPSS score or SSVC decision was available. Treat it as routine patching: apply the Red Hat errata for the affected RHOAI images and rebuild any custom images that bundle SQLite.
What is the risk?
Low to moderate. CVSS 4.7 reflects local access, high attack complexity and required user interaction, with no confidentiality or integrity impact. There is no known exploitation (not in KEV), no public PoC and no scanner template. Exposure is mainly crash-driven availability loss in components that parse untrusted JSON through SQLite JSON functions. Memory-corruption bugs of this class (CWE-416) can sometimes be escalated, but nothing public suggests that here. The package risk score (81/100), the OpenSSF Scorecard of 5.4/10 and the high number of related CVEs show a sizeable, imperfectly hardened dependency footprint.
How does the attack unfold?
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Check the Red Hat CVE page (access.redhat.com/security/cve/CVE-2024-0232) and Bugzilla 2243754 for fixed SQLite builds, and apply errata to the affected RHOAI images. 2) Rebuild and redeploy custom images and notebooks that statically or dynamically bundle SQLite from a patched base. 3) Run an SBOM or container scan (Trivy, Grype, ACS) to find vulnerable SQLite versions across your AI/ML estate. 4) As a workaround, avoid passing untrusted JSON to SQLite JSON functions, and restrict who can submit input to local tooling. 5) Monitor for repeated crashes or segfaults and CrashLoopBackOff in affected pods, and make sure Kubernetes restart policies and health checks keep services recoverable.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2024-0232?
CVE-2024-0232 is a heap use-after-free in SQLite's JSON parsing code (jsonParseAddNodeArray) that lets crafted JSON input crash the host application and cause a denial of service. It matters for AI teams because SQLite is embedded throughout the Red Hat OpenShift AI (RHOAI) container images listed as affected, including the dashboard, KServe controllers, MLflow, model registry and notebook controllers. That gives it a wide footprint, with 695 downstream dependents and 137 other tracked CVEs in the same package. Exploitation risk is low: the vector is local, complexity is high, user interaction is required, and the impact is availability only (CVSS 4.7). It is not in CISA KEV, no public exploit or Nuclei template exists, and no EPSS score or SSVC decision was available. Treat it as routine patching: apply the Red Hat errata for the affected RHOAI images and rebuild any custom images that bundle SQLite.
Is CVE-2024-0232 actively exploited?
No confirmed active exploitation of CVE-2024-0232 has been reported, but organizations should still patch proactively.
How to fix CVE-2024-0232?
1) Check the Red Hat CVE page (access.redhat.com/security/cve/CVE-2024-0232) and Bugzilla 2243754 for fixed SQLite builds, and apply errata to the affected RHOAI images. 2) Rebuild and redeploy custom images and notebooks that statically or dynamically bundle SQLite from a patched base. 3) Run an SBOM or container scan (Trivy, Grype, ACS) to find vulnerable SQLite versions across your AI/ML estate. 4) As a workaround, avoid passing untrusted JSON to SQLite JSON functions, and restrict who can submit input to local tooling. 5) Monitor for repeated crashes or segfaults and CrashLoopBackOff in affected pods, and make sure Kubernetes restart policies and health checks keep services recoverable.
What systems are affected by CVE-2024-0232?
This vulnerability affects the following AI/ML architecture patterns: Model serving, Training pipelines, ML experiment tracking, Model registries, Notebook and workbench environments, Kubernetes-based ML operators.
What is the CVSS score for CVE-2024-0232?
CVE-2024-0232 has a CVSS v3.1 base score of 4.7 (MEDIUM).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011User ExecutionAML.T0029Denial of AI ServiceCompliance Controls Affected
What are the technical details?
Original Advisory
A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.
Exploitation Scenario
An attacker with local or low-level access to an ML platform persuades a data scientist or an automated workflow to open or process a crafted JSON document, such as an experiment metadata file, a model registry entry or a notebook artifact. The document is parsed by a component that uses SQLite JSON functions. The use-after-free triggers a heap fault and the process crashes. Repeating the trigger could keep a model-serving controller, tracking service or pipeline operator down and disrupt ML operations. No public exploit or remote vector exists.
Weaknesses (CWE)
CWE-416 — Use After Free: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
- [Architecture and Design] Choose a language that provides automatic memory management.
- [Implementation] When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HReferences
- access.redhat.com/security/cve/CVE-2024-0232vdb-entryx_refsource_REDHAT
- bugzilla.redhat.com/show_bug.cgiissue-trackingx_refsource_REDHAT
Timeline
Related Vulnerabilities
CVE-2025-1537910.0MLflow: RCE via unsanitized model dependency specs
Same package: mlflowCVE-2023-376510.0MLflow: path traversal allows arbitrary file read
Same package: mlflowCVE-2023-11779.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflowCVE-2026-26359.8mlflow: security flaw enables exploitation
Same package: mlflowCVE-2023-27809.8MLflow: path traversal allows arbitrary file read/write
Same package: mlflow