PatchTheCVECVE-2020-11656: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY
68
This week
CRITICAL 9.8REMOTEWATCHLISTUPGRADEMITIGATEUPGRADE
CVE-2020-11656 is a critical-severity flaw (CVSS 9.8) affecting sqlite, ontap select deploy administration utility, communications network charging and control. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
Why this priority
- Critical severity
- EPSS top 5%: very likely to be exploited
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 8.7% (top 5%) |
| CISA exploited list | No |
| Weakness | CWE-416 |
| Published | 2020-04-09 |
| Last modified | 2026-10-14 |
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
sqlite sqlite UPGRADE
Affected: <= 3.31.1
Fixed in: newer than 3.31.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy sqlite || rpm -q sqlite || sqlite --version
2. UPGRADE to newer than 3.31.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade sqlite
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade sqlite
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
netapp ontap select deploy administration utility MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy ontap-select-deploy-administration-utility || rpm -q ontap-select-deploy-administration-utility || ontap-select-deploy-administration-utility --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
oracle communications network charging and control UPGRADE
Affected: >= 12.0.0 and <= 12.0.3 · 6.0.1 · 12.0.2
Fixed in: newer than 12.0.3
Safe to downgrade to: a release before 6.0.1
1. Check installed version
apt-cache policy communications-network-charging-and-control || rpm -q communications-network-charging-and-control || communications-network-charging-and-control --version
2. UPGRADE to newer than 12.0.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade communications-network-charging-and-control
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade communications-network-charging-and-control
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 6.0.1 (Debian / Ubuntu)
apt-cache madison communications-network-charging-and-control
sudo apt install communications-network-charging-and-control=<VERSION_BEFORE_6.0.1>
sudo apt-mark hold communications-network-charging-and-control
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list communications-network-charging-and-control
sudo dnf downgrade communications-network-charging-and-control-<VERSION_BEFORE_6.0.1>
sudo dnf versionlock add communications-network-charging-and-control
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle enterprise manager ops center DOWNGRADE
Affected: 12.4.0.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 12.4.0.0
1. Check installed version
apt-cache policy enterprise-manager-ops-center || rpm -q enterprise-manager-ops-center || enterprise-manager-ops-center --version
2. No fixed release: DOWNGRADE to a release before 12.4.0.0 (Debian / Ubuntu)
apt-cache madison enterprise-manager-ops-center
sudo apt install enterprise-manager-ops-center=<VERSION_BEFORE_12.4.0.0>
sudo apt-mark hold enterprise-manager-ops-center
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list enterprise-manager-ops-center
sudo dnf downgrade enterprise-manager-ops-center-<VERSION_BEFORE_12.4.0.0>
sudo dnf versionlock add enterprise-manager-ops-center
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle hyperion infrastructure technology DOWNGRADE
Affected: 11.1.2.4
Fixed in: no fixed release known
Safe to downgrade to: a release before 11.1.2.4
1. Check installed version
apt-cache policy hyperion-infrastructure-technology || rpm -q hyperion-infrastructure-technology || hyperion-infrastructure-technology --version
2. No fixed release: DOWNGRADE to a release before 11.1.2.4 (Debian / Ubuntu)
apt-cache madison hyperion-infrastructure-technology
sudo apt install hyperion-infrastructure-technology=<VERSION_BEFORE_11.1.2.4>
sudo apt-mark hold hyperion-infrastructure-technology
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list hyperion-infrastructure-technology
sudo dnf downgrade hyperion-infrastructure-technology-<VERSION_BEFORE_11.1.2.4>
sudo dnf versionlock add hyperion-infrastructure-technology
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle mysql UPGRADE
Affected: >= 8.0.0 and <= 8.0.22
Fixed in: newer than 8.0.22
Safe to downgrade to: a release before 8.0.0
1. Check installed version
apt-cache policy mysql || rpm -q mysql || mysql --version
2. UPGRADE to newer than 8.0.22 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade mysql
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade mysql
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 8.0.0 (Debian / Ubuntu)
apt-cache madison mysql
sudo apt install mysql=<VERSION_BEFORE_8.0.0>
sudo apt-mark hold mysql
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list mysql
sudo dnf downgrade mysql-<VERSION_BEFORE_8.0.0>
sudo dnf versionlock add mysql
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-11656?
sqlite: upgrade to newer than 3.31.1; ontap select deploy administration utility: mitigate or apply the listed mitigation; communications network charging and control: upgrade to newer than 12.0.3. Exact commands for each OS are on this page.
Is CVE-2020-11656 being exploited?
CVE-2020-11656 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-11656 affect?
CVE-2020-11656 affects sqlite, ontap select deploy administration utility, communications network charging and control. Severity is critical (CVSS 9.8). In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
How urgent is CVE-2020-11656?
Priority 68/100. Critical severity; EPSS top 5%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist
Software pages
MySQL vulnerabilities · SQLite vulnerabilities
Related CVEs
- CVE-2026-11822 MEDIUM 5.5 UPGRADE SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that
- CVE-2025-70873 HIGH 7.5 UPGRADE An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and
- CVE-2025-6965 HIGH 7.7 UPGRADE UPGRADE There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed
- CVE-2025-3277 CRITICAL 9.8 UPGRADE An integer overflow can be triggered in SQLite’s `concat_ws()` function
- CVE-2025-29088 MEDIUM 5.6 DOWNGRADE In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause