Read the docs
TI-2023-26543 Aliases CVE-2023-48704

Unauthenticated heap buffer overflow in Gorrila codec decompression

Priority LOW 33CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.

Why it matters now

EPSS 0.00495 42nd percentileScored 2026-11-07
Fix Fixed ClickHouse (ClickHouse): 23.9.2.47551, 23.10.5.20, 23.3.18.15 +2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ClickHouseClickHousebefore 23.9.2.47551; before 23.10.5.20; before 23.3.18.15; before 23.8.8.20; before 23.9.6.2023.9.2.47551, 23.10.5.20, 23.3.18.15, 23.8.8.20, 23.9.6.20Patch availableCNA
  • ClickHouse VendorClickHouse Affected before 23.9.2.47551; before 23.10.5.20; before 23.3.18.15; before 23.8.8.20; before 23.9.6.20 Fixed in 23.9.2.47551, 23.10.5.20, 23.3.18.15, 23.8.8.20, 23.9.6.20 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:*23.3 to before 23.3.18.15; 23.8 to before 23.8.8.20; 23.9 to before 23.9.6.20; 23.10 to before 23.10.5.20VulnerableClickHouse
cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:*before 23.9.2.47551VulnerableClickHouse
  • cpe:2.3:a:clickhouse:clickhouse:*:*:*:*:*:*:*:* Versions 23.3 to before 23.3.18.15; 23.8 to before 23.8.8.20; 23.9 to before 23.9.6.20; 23.10 to before 23.10.5.20 Vulnerable ·ClickHouse
  • cpe:2.3:a:clickhouse:clickhouse_cloud:*:*:*:*:*:*:*:* Versions before 23.9.2.47551 Vulnerable ·ClickHouse

Remediation

  • Fix · CNA ClickHouse (ClickHouse) Fixed in 23.9.2.47551, 23.10.5.20, 23.3.18.15, 23.8.8.20, 23.9.6.20

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48704

References

Patch 1

Advisory 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-27624 ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl. CVSS 3.1HIGH 7.5
  • TI-2024-14986 ClickHouse's Role-based Access Control is bypassed when query caching is enabled. CVSS 3.1MEDIUM 4.9
  • TI-2018-10534 Improper input validation in ClickHouse CVSS 3.0CRITICAL 9.8
  • TI-2018-10533 Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. CVSS 3.0CRITICAL 9.8
  • TI-2019-12398 Out-of-bounds read in ClickHouse CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences