CVE-2021-20227
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an...
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
- Record
CVE-2021-20227- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
- Record
CVE-2021-20227- Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2021-7667 No score
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
- Record
EUVD-2021-7667- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w586-cvch-p9ch
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an...
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
- Record
GHSA-w586-cvch-p9ch- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-20227
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
- Record
ALPINE-CVE-2021-20227- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2021-20227
CVE-2021-20227 does not affect BellSoft software
- Record
BELL-CVE-2021-20227- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSV
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
- Record
CVE-2021-20227- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-20227
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
- Record
DEBIAN-CVE-2021-20227- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2021-1252
sqlite security update
SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day. It also include lemon and sqlite3_analyzer and tcl tools.
Security Fix(es):
A flaw was found in SQLite s SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.(CVE-2021-20227)
- Record
OESA-2021-1252- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-sqlite-2021-20227 No score
A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.
- Record
BIT-sqlite-2021-20227- Updated
- 2026-11-02
Affected products
- sqlite
- oracle communications network charging and control
- oracle enterprise manager for oracle database
- oracle jd edwards enterpriseone tools
- oracle mysql workbench
- oracle outside in technology
- oracle zfs storage appliance kit
- siemens simatic s7-1500 cpu 1518-4 pn/dp mfp
- siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp
- siemens siplus s7-1500 cpu 1518-4 pn/dp mfp
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sqliteAlpine:v3.12 |
3.33.0 up to 3.32.1-r1 | 3.32.1-r1 |
sqliteAlpine:v3.14 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteAlpine:v3.15 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteAlpine:v3.16 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteAlpine:v3.17 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteAlpine:v3.18 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteAlpine:v3.19 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteAlpine:v3.20 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteAlpine:v3.21 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteAlpine:v3.22 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sqliteAlpine:v3.23 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteAlpine:v3.24 |
3.33.0 up to 3.34.1-r0 | 3.34.1-r0 |
sqliteBitnami |
3.33.0 up to 3.34.1 | 3.34.1 |
sqlite3Debian:12 |
before 3.34.1-1 | 3.34.1-1 |
sqlite3Debian:13 |
before 3.34.1-1 | 3.34.1-1 |
sqlite3Debian:14 |
before 3.34.1-1 | 3.34.1-1 |
sqliteopenEuler:20.03-LTS-SP1 |
before 3.32.3-3.oe1 | 3.32.3-3.oe1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-20227 is a medium vulnerability (CVSS 5.5) in Sqlite, published March 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in sqlite 3.32.1-r1.
References
bugzilla.redhat.com/show_bug.cgi?id=1924886
sqlite.org/releaselog/3_34_1.html
security.gentoo.org/glsa/202103-04
oracle.com/security-alerts/cpuApr2021.html
security.netapp.com/advisory/ntap-20210423-0010
Show 9 moreShow less
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2021-20227
github.com/advisories/GHSA-w586-cvch-p9ch
security.alpinelinux.org/vuln/CVE-2021-20227
docs.bell-sw.com/security/cves/CVE-2021-20227
security-tracker.debian.org/tracker/CVE-2021-20227
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1252