Clickhouse - vulnerabilities (CVEs)
28 CVEs in 6 products, 1 in the last 30 days, newest from 2026-10-22.
Products
- Clickhouse - 24 CVEs
- Clickhouse Cloud - 4 CVEs
- Ch - 1 CVEs
- Clickhouse Oss - 1 CVEs
- Db - 1 CVEs
- Java Libraries - 1 CVEs
Newest CVEs of Clickhouse
- CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
- CVE-2019-16536 - CVSS 8.8 (high), 2025-05-21: Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.
- CVE-2025-1386 - CVSS 5.9 (medium), 2025-04-11: When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker…
- CVE-2025-1385 - CVSS 7.5 (high), 2025-03-20: When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load…
- CVE-2024-41436 - CVSS 7.5 (high), 2024-09-03: ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
- CVE-2024-6873 - CVSS 8.1 (high), 2024-08-01: It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request…
- CVE-2024-22412 - CVSS 4.9 (medium), 2024-03-18: ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in…
- CVE-2024-23689 - CVSS 8.8 (high), 2024-01-19: Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client…
- CVE-2023-48704 - CVSS 7.5 (high), 2023-12-22: ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow…
- CVE-2023-48298 - CVSS 7.5 (high), 2023-12-21: ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an…
- CVE-2023-47118 - CVSS 9.8 (critical), 2023-12-20: ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow…
- CVE-2022-44011 - CVSS 6.5 (medium), 2023-11-23: An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability to load data) could cause a heap buffer overflow and crash…
- CVE-2022-44010 - CVSS 7.5 (high), 2023-11-23: An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP Endpoint (usually listening on port 8123…
- CVE-2021-42389 - CVSS 6.5 (medium), 2022-03-14: Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation…
- CVE-2021-43304 - CVSS 8.8 (high), 2022-03-14: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the…
- CVE-2021-42391 - CVSS 6.5 (medium), 2022-03-14: Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation…
- CVE-2021-42390 - CVSS 6.5 (medium), 2022-03-14: Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo…
- CVE-2021-43305 - CVSS 8.8 (high), 2022-03-14: Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the…
- CVE-2021-42388 - CVSS 8.1 (high), 2022-03-14: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned…
- CVE-2021-42387 - CVSS 8.1 (high), 2022-03-14: Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned…
- CVE-2019-16535 - CVSS 9.8 (critical), 2019-12-30: In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via…
- CVE-2019-15024 - CVSS 6.5 (medium), 2019-12-30: In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network…
- CVE-2019-18657 - CVSS 5.3 (medium), 2019-10-31: ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.
- CVE-2018-14672 - CVSS 5.3 (medium), 2019-08-15: In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.
- CVE-2018-14669 - CVSS 7.5 (high), 2019-08-15: ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary…
- CVE-2018-14671 - CVSS 9.8 (critical), 2019-08-15: In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.
- CVE-2018-14668 - CVSS 8.8 (high), 2019-08-15: In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross…
- CVE-2018-14670 - CVSS 9.8 (critical), 2019-08-15: Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.
