Read the docs
TI-2023-25458 Aliases CVE-2023-47118

Heap buffer overflow in T64 codec decompression

Priority MEDIUM 42CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of T64 codec that crashes the ClickHouse server process. This attack does not require authentication. Note that this exploit can also be triggered via HTTP protocol, however, the attacker will need a valid credential as the HTTP authentication take places first. This issue has been fixed in version 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts and 23.3.16.7-lts.

Why it matters now

EPSS 0.00462 40th percentileScored 2026-11-07
Fix Fixed ClickHouse (ClickHouse): 23.3.16.7-lts

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ClickHouseClickHousebefore 23.3.16.7-lts23.3.16.7-ltsPatch availableCNA
  • ClickHouse VendorClickHouse Affected before 23.3.16.7-lts Fixed in 23.3.16.7-lts Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:lts:*:*:*23.3 to before 23.3.16.7; 23.8 to before 23.8.6.16VulnerableClickHouse
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*23.9 to before 23.9.4.11; 23.10 to before 23.10.2.13VulnerableClickHouse
cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:*before 23.9.2.47475VulnerableClickHouse
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:lts:*:*:* Versions 23.3 to before 23.3.16.7; 23.8 to before 23.8.6.16 Vulnerable ·ClickHouse
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* Versions 23.9 to before 23.9.4.11; 23.10 to before 23.10.2.13 Vulnerable ·ClickHouse
  • cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:* Versions before 23.9.2.47475 Vulnerable ·ClickHouse

Remediation

  • Fix · CNA ClickHouse (ClickHouse) Fixed in 23.3.16.7-lts

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-47118

References

Advisory 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-27624 ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl. CVSS 3.1HIGH 7.5
  • TI-2024-14986 ClickHouse's Role-based Access Control is bypassed when query caching is enabled. CVSS 3.1MEDIUM 4.9
  • TI-2018-10534 Improper input validation in ClickHouse CVSS 3.0CRITICAL 9.8
  • TI-2018-10533 Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. CVSS 3.0CRITICAL 9.8
  • TI-2019-12398 Out-of-bounds read in ClickHouse CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences