Read the docs
TI-2025-01189 Aliases CVE-2025-1385

Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Fixed ClickHouse OSS (ClickHouse): 24.3.18.6, 24.8.14.27, 24.11.5.34 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ClickHouseClickHouse OSS24.3 to before 24.3.18.6; 24.8 to before 24.8.14.27; 24.11 to before 24.11.5.34; 24.12 to before 24.12.5.65; 25.1 to before 25.1.5.524.3.18.6, 24.8.14.27, 24.11.5.34, 24.12.5.65, 25.1.5.5Patch availableCNA
  • ClickHouse OSS VendorClickHouse Affected 24.3 to before 24.3.18.6; 24.8 to before 24.8.14.27; 24.11 to before 24.11.5.34; 24.12 to before 24.12.5.65; 25.1 to before 25.1.5.5 Fixed in 24.3.18.6, 24.8.14.27, 24.11.5.34, 24.12.5.65, 25.1.5.5 Patch available CNA

Remediation

  • Fix · CNA ClickHouse OSS (ClickHouse) Fixed in 24.3.18.6, 24.8.14.27, 24.11.5.34, 24.12.5.65, 25.1.5.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1385

References

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-15707 ClickHouse Client Certificate Password Exposure CVSS 3.1HIGH 8.8
  • TI-2024-27624 ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl. CVSS 3.1HIGH 7.5
  • TI-2024-14986 ClickHouse's Role-based Access Control is bypassed when query caching is enabled. CVSS 3.1MEDIUM 4.9
  • TI-2018-10534 Improper input validation in ClickHouse CVSS 3.0CRITICAL 9.8
  • TI-2018-10533 Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences