Every CVE Search/ Get API key

CVE-2021-20223

An issue was found in fts5UnicodeTokenize() in ext/fts5/fts5_tokenize.c in Sqlite. A unicode61...

9.8 CriticalFix availableRejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

What each source reports

GitHub Advisories Score usedGHSA-r7v8-jjhj-75h7 9.8

An issue was found in fts5UnicodeTokenize() in ext/fts5/fts5_tokenize.c in Sqlite. A unicode61...

An issue was found in fts5UnicodeTokenize() in ext/fts5/fts5_tokenize.c in Sqlite. A unicode61 tokenizer configured to treat unicode "control-characters" (class Cc), was treating embedded nul characters as tokens. The issue was fixed in sqlite-3.34.0 and later.

Record
GHSA-r7v8-jjhj-75h7
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
CVE List No score

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
CVE-2021-20223
Updated
2026-11-02
EUVDEUVD-2021-7663 9.8

An issue was found in fts5UnicodeTokenize() in ext/fts5/fts5_tokenize.c in Sqlite. A unicode61 tokenizer configured to treat unicode "control-characters" (class Cc), was treating embedded nul characters as tokens. The issue was fixed in sqlite-3.34.0 and later.

Record
EUVD-2021-7663
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
NVD No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
CVE-2021-20223
Updated
2026-11-02
OSVOESA-2022-1876 9.8

sqlite security update

SQLite is a C-language library that implements a small, fast, self-contained,high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.

Security Fix(es):

An issue was found in fts5UnicodeTokenize() in ext/fts5/fts5_tokenize.c in Sqlite. A unicode61 tokenizer configured to treat unicode "control-characters" (class Cc), was treating embedded nul characters as tokens. The issue was fixed in sqlite-3.34.0 and later.(CVE-2021-20223)

Record
OESA-2022-1876
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-1877 9.8

sqlite security update

SQLite is a C-language library that implements a small, fast, self-contained,high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.

Security Fix(es):

An issue was found in fts5UnicodeTokenize() in ext/fts5/fts5_tokenize.c in Sqlite. A unicode61 tokenizer configured to treat unicode "control-characters" (class Cc), was treating embedded nul characters as tokens. The issue was fixed in sqlite-3.34.0 and later.(CVE-2021-20223)

Record
OESA-2022-1877
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2021-20223 9.8

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Record
UBUNTU-CVE-2021-20223
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2022-1665073456 No score

Fixed CVEs in sqlite: CVE-2020-35525, CVE-2021-20223

  • CVE-2021-20223: prevent fts5 tokenizer unicode61 from considering '\0' to be a token characters, even if other characters of class "Cc" are.
  • CVE-2020-35525: fix a potential null pointer dereference.
Record
CLSA-2022-1665073456
Updated
2026-11-02
OSVCLSA-2022-1665073587 No score

Fixed CVEs in sqlite: CVE-2020-35525, CVE-2021-20223

  • CVE-2021-20223: prevent fts5 tokenizer unicode61 from considering '\0' to be a token characters, even if other characters of class "Cc" are.
  • CVE-2020-35525: fix a potential null pointer dereference.
Record
CLSA-2022-1665073587
Updated
2026-11-02
OSVUSN-5615-1 No score

sqlite3 vulnerabilities

It was discovered that SQLite incorrectly handled INTERSEC query processing. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-35525)

It was discovered that SQLite incorrectly handled ALTER TABLE for views that have a nested FROM clause. An attacker could use this issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue was only addressed in Ubuntu 20.04 LTS. (CVE-2020-35527)

It was discovered that SQLite incorrectly handled embedded null characters when tokenizing certain unicode strings. This issue could result in incorrect results. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-20223)

Record
USN-5615-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
lemon
TuxCare:CentOS:8.4
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite
TuxCare:CentOS:8.4
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite-analyzer
TuxCare:CentOS:8.4
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite-devel
TuxCare:CentOS:8.4
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite-doc
TuxCare:CentOS:8.4
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite-libs
TuxCare:CentOS:8.4
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite-tcl
TuxCare:CentOS:8.4
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
lemon
TuxCare:CentOS:8.5
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite
TuxCare:CentOS:8.5
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite-analyzer
TuxCare:CentOS:8.5
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
sqlite-devel
TuxCare:CentOS:8.5
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite-doc
TuxCare:CentOS:8.5
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite-libs
TuxCare:CentOS:8.5
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite-tcl
TuxCare:CentOS:8.5
From an advisory covering 2 CVEs
 before 3.26.0-15.el8.tuxcare.els1
3.26.0-15.el8.tuxcare.els1
sqlite
openEuler:20.03-LTS-SP1
 before 3.32.3-5.oe1
3.32.3-5.oe1
sqlite
openEuler:20.03-LTS-SP3
 before 3.32.3-5.oe1
3.32.3-5.oe1
sqlite3
Ubuntu:20.04:LTS
 before 3.31.1-4ubuntu0.4, plus listed versions
3.29.0-23.30.1-13.30.1-1ubuntu13.31.1-1ubuntu13.31.1-3
Show 4 moreShow less
3.31.1-43.31.1-4ubuntu0.13.31.1-4ubuntu0.23.31.1-4ubuntu0.3
3.31.1-4ubuntu0.4
sqlite3
Ubuntu:18.04:LTS
From an advisory covering 3 CVEs
 before 3.22.0-1ubuntu0.6, plus listed versions
3.19.3-33.20.1-23.21.0-13.22.0-13.22.0-1ubuntu0.1
Show 4 moreShow less
3.22.0-1ubuntu0.23.22.0-1ubuntu0.33.22.0-1ubuntu0.43.22.0-1ubuntu0.5
3.22.0-1ubuntu0.6
sqlite3
Ubuntu:20.04:LTS
From an advisory covering 3 CVEs
 before 3.31.1-4ubuntu0.4, plus listed versions
3.29.0-23.30.1-13.30.1-1ubuntu13.31.1-1ubuntu13.31.1-3
Show 4 moreShow less
3.31.1-43.31.1-4ubuntu0.13.31.1-4ubuntu0.23.31.1-4ubuntu0.3
3.31.1-4ubuntu0.4

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-20223 has been rejected by its source and should not be treated as a live vulnerability, published August 25, 2022. Fixed in sqlite 3.32.3-5.oe1.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open