Read the docs

ClickHouse

Records29All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high14CVSS 7.0–8.9

Exploited now

ClickHouse records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27

Components

Products in the NVD configurations · select one to filter the records
Clickhouse 24 records CRITICAL Clickhouse Cloud 4 records MEDIUM Ch 1 record LOW Java Libraries 1 record HIGH

Records

29 records

TI-2026-79288 CVE-2026-111497 · GHSA-9v8h-qqgm-4m35

Out-of-bounds write in Google Brotli decoder

Priority CRITICAL 99KEV

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.82641 Published 2026-10-22 Partial fix · 1.0.10, 1.1.1 +2 CWE-252
TI-2024-15707 CVE-2024-23689 · GHSA-g8ph-74m6-8m7r

ClickHouse Client Certificate Password Exposure

Priority HIGH 73

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00676 Published 2024-01-19 Fixed in 0.4.6 CWE-209
TI-2018-10534 CVE-2018-14671 · GHSA-82pw-c344-33pq

Improper input validation in ClickHouse

Priority MEDIUM 48

In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03422 Published 2019-08-15 No fix listed CWE-20
TI-2026-82977 CVE-2026-116366 · GHSA-qhgw-ghp3-xh36

Unauthenticated remote code execution in ClickHouse Server

Priority MEDIUM 45

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00962 Published 2026-10-30 Fixed in 26.3.62.3-lts, 26.8.36.3-lts +8 CWE-190
TI-2019-12398 CVE-2019-16535 · GHSA-x3fg-74w9-f5r4

Out-of-bounds read in ClickHouse

Priority MEDIUM 45

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01695 Published 2019-12-30 No fix listed CWE-125
TI-2019-12399 CVE-2019-16536 · GHSA-5xwv-wjhm-pv8f

Buffer overflow in ClickHouse DB

Priority MEDIUM 43

Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00903 Published 2025-05-21 No fix listed CWE-120
TI-2023-25458 CVE-2023-47118

Heap buffer overflow in T64 codec decompression

Priority MEDIUM 42

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00462 Published 2023-12-20 Fixed in 23.3.16.7-lts CWE-122
TI-2021-19298 CVE-2021-43305 · GHSA-rjm8-hjq2-73j6

Heap-based buffer overflow in Yandex clickhouse

Priority MEDIUM 41

Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01672 Published 2022-03-14 Fixed in 21.10.2.15-stable CWE-122
TI-2021-19297 CVE-2021-43304 · GHSA-4px5-4p3v-7568

Heap-based buffer overflow in Yandex clickhouse

Priority MEDIUM 41

Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01672 Published 2022-03-14 Fixed in 21.10.2.15-stable CWE-122
TI-2018-10531 CVE-2018-14668 · GHSA-64r6-35gw-xgw4

Cross-site request forgery in ClickHouse

Priority LOW 39

In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery Attacks.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00716 Published 2019-08-15 No fix listed CWE-352
TI-2021-18802 CVE-2021-42388 · GHSA-gg7g-5hm7-ggx5

Out-of-bounds read in Yandex clickhouse

Priority LOW 38

Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01573 Published 2022-03-14 Fixed in 21.10.2.15-stable CWE-125
TI-2021-18801 CVE-2021-42387 · GHSA-cf9g-639p-3wvv

Out-of-bounds read in Yandex clickhouse

Priority LOW 38

Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01573 Published 2022-03-14 Fixed in 21.10.2.15-stable CWE-125
TI-2018-10532 CVE-2018-14669 · GHSA-7j36-vrpv-9wqr

Information disclosure in ClickHouse

Priority LOW 36

ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the connected ClickHouse server.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01711 Published 2019-08-15 No fix listed CWE-200
TI-2019-11210 CVE-2019-15024 · GHSA-vv4f-6f99-x599

In all versions of ClickHouse before 19.14.3, an attacker having write access to…

Priority LOW 31

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious serv…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00949 Published 2019-12-30 No fix listed
Load more
Open these records in search →