clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.0269·Published 2021-01-06·Fixed in 0.1.5CWE-120