Clickhouse vulnerabilities

Products

• Clickhouse 26
• Cloud 4
• Db 2

Newest

• clickhouse, clickhouse cloud +1 more Unauthenticated RCE vulnerability against ClickHouse Server CVE-2026-116366 Public exploit 9.5 CriticalOctober 30, 2026
• clickhouse db tanstack db Alias Path select.ts select prototype pollution CVE-2026-15607 5.3 MediumJuly 13, 2026
• andybalholm brotli, 7-zip p7zip, anthropic bun +39 more +41 more Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 In KEVPublic exploitFix available EPSS 82.6% 9.2 CriticalApril 27, 2026
• clickhouse, clickhouse db +1 more Stack overflow leading to DoS can be triggered by a malicious authenticated client. CVE-2019-16536 8.2 HighMay 21, 2025
• ch-go, clickhouse ch +1 more Query smuggling in ch-go library CVE-2025-1386 Fix available 5.9 MediumApril 11, 2025
• clickhouse oss Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration CVE-2025-1385 7.5 HighMarch 20, 2025
• clickhouse ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB:... CVE-2024-41436 7.5 HighSeptember 3, 2024
• clickhouse Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution. CVE-2024-6873 8.1 HighAugust 1, 2024
• clickhouse, clickhouse cloud +1 more ClickHouse's Role-based Access Control is bypassed when query caching is enabled. CVE-2024-22412 2.4 LowMarch 18, 2024
• clickhouse, clickhouse cloud +1 more Unauthenticated heap buffer overflow in Gorrila codec decompression CVE-2023-48704 7.0 HighDecember 22, 2023
• clickhouse, clickhouse cloud +1 more Integer underflow leading to stack overflow in FPC codec decompression CVE-2023-48298 5.9 MediumDecember 21, 2023
• clickhouse, clickhouse cloud +1 more Heap buffer overflow in T64 codec decompression CVE-2023-47118 7.0 HighDecember 20, 2023
• clickhouse An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability... CVE-2022-44011 6.5 MediumNovember 23, 2023
• clickhouse An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP... CVE-2022-44010 7.5 HighNovember 23, 2023
• clickhouse java libraries ClickHouse Client Certificate Password Exposure CVE-2024-23689 Fix available 8.8 HighMay 12, 2023
• clickhouse Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The... CVE-2021-42391 6.5 MediumMarch 14, 2022
• clickhouse Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The... CVE-2021-42390 6.5 MediumMarch 14, 2022
• clickhouse Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first... CVE-2021-42389 6.5 MediumMarch 14, 2022
• clickhouse, debian linux +1 more Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There... CVE-2021-43305 Fix available 8.8 HighMarch 14, 2022
• clickhouse, debian linux +1 more Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There... CVE-2021-43304 Fix available 8.8 HighMarch 14, 2022
• clickhouse, debian linux +1 more Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As... CVE-2021-42388 Fix available 8.1 HighMarch 14, 2022
• clickhouse, debian linux +1 more Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As... CVE-2021-42387 Fix available 8.1 HighMarch 14, 2022
• clickhouse In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and... CVE-2019-15024 6.5 MediumDecember 30, 2019
• clickhouse In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in... CVE-2019-16535 9.8 CriticalDecember 30, 2019
• clickhouse ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function. CVE-2019-18657 5.3 MediumOctober 31, 2019
• clickhouse In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and... CVE-2018-14672 5.3 MediumAugust 15, 2019
• clickhouse In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file... CVE-2018-14671 9.8 CriticalAugust 15, 2019
• clickhouse ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality... CVE-2018-14669 7.5 HighAugust 15, 2019
• clickhouse In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", ... CVE-2018-14668 8.8 HighAugust 15, 2019
• clickhouse Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized... CVE-2018-14670 9.8 CriticalAugust 15, 2019