---
id: CVE-2021-20227
title: A flaw was found in SQLite's SELECT query functionality (src/select.c)
summary: >-
  A flaw was found in SQLite's SELECT query functionality (src/select.c). This
  flaw allows an attacker who is capable of running SQL queries locally on the
  SQLite database to cause a denial of service or possible code execution by
  triggeri…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-416
  - CWE-416
vendor: sqlite
product: sqlite
affected:
  - 'sqlite >= 3.33.0, < 3.34.1'
  - 'communications_network_charging_and_control >= 12.0.1.0, <= 12.0.4.0.0'
  - communications_network_charging_and_control = 6.0.1
  - enterprise_manager_for_oracle_database = 13.4.0.0
  - jd_edwards_enterpriseone_tools < 9.2.6.0
  - mysql_workbench <= 8.0.26
  - outside_in_technology = 8.5.5
  - zfs_storage_appliance_kit = 8.8
patched:
  - sqlite 3.34.1
  - jd_edwards_enterpriseone_tools 9.2.6.0
published: '2021-03-23'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T11:16:51.263'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-20227'
references:
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1924886'
    label: secalert@redhat.com
  - url: 'https://security.gentoo.org/glsa/202103-04'
    label: secalert@redhat.com
  - url: 'https://security.gentoo.org/glsa/202210-40'
    label: secalert@redhat.com
  - url: 'https://security.netapp.com/advisory/ntap-20210423-0010/'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com//security-alerts/cpujul2021.html'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html'
    label: secalert@redhat.com
  - url: 'https://www.sqlite.org/releaselog/3_34_1.html'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1924886'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202103-04'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202210-40'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20210423-0010/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com//security-alerts/cpujul2021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.sqlite.org/releaselog/3_34_1.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.00496
epssPercentile: 0.40863
ingestedAt: '2026-10-14T11:27:22.121Z'
---

## Overview

A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible code execution by triggering a use-after-free. The highest threat from this vulnerability is to system availability.

## Affected

- `sqlite >= 3.33.0, < 3.34.1`
- `communications_network_charging_and_control >= 12.0.1.0, <= 12.0.4.0.0`
- `communications_network_charging_and_control = 6.0.1`
- `enterprise_manager_for_oracle_database = 13.4.0.0`
- `jd_edwards_enterpriseone_tools < 9.2.6.0`
- `mysql_workbench <= 8.0.26`
- `outside_in_technology = 8.5.5`
- `zfs_storage_appliance_kit = 8.8`

## Remediation

Upgrade past the affected range:

- `sqlite 3.34.1`
- `jd_edwards_enterpriseone_tools 9.2.6.0`