CVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
Published Apr 9, 2020 · updated Oct 14, 2026 · sqlite sqlite
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 9, 2020 · NIST NVD
Detected
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
Oct 14, 2026 · NIST NVD
Updated
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
Affected
- cpe netapp/ontap select deploy administration utilityversion unspecified
- cpe oracle/communications network charging and controlversion unspecified
- cpe oracle/communications network charging and control12.0.2
- cpe oracle/communications network charging and control6.0.1
- cpe oracle/enterprise manager ops center12.4.0.0
- cpe oracle/hyperion infrastructure technology11.1.2.4
- cpe oracle/mysqlversion unspecified
- cpe siemens/sinec infrastructure network servicesversion unspecified
- cpe sqlite/sqliteversion unspecified
- cpe tenable/tenable.scversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2020-11656
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2020-11656
30-day exploitation probability 8.7%
first.org - NIST NVDVulnerability recordCVE-2020-11656
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
nvd.nist.gov