Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

29 records

Vendor: ClickHouse Clear all filters
TI-2026-82977 CVE-2026-116366 · GHSA-qhgw-ghp3-xh36

Unauthenticated remote code execution in ClickHouse Server

Priority MEDIUM 45

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00962 Published 2026-10-30 Fixed in 26.3.62.3-lts, 26.8.36.3-lts +8 CWE-190
TI-2026-79288 CVE-2026-111497 · GHSA-9v8h-qqgm-4m35

Out-of-bounds write in Google Brotli decoder

Priority CRITICAL 99KEV

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.82641 Published 2026-10-22 Partial fix · 1.0.10, 1.1.1 +2 CWE-252
TI-2019-12399 CVE-2019-16536 · GHSA-5xwv-wjhm-pv8f

Buffer overflow in ClickHouse DB

Priority MEDIUM 43

Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.

CVSS 4.0HIGH 8.2 Network High privileges No interaction EPSS 0.00903 Published 2025-05-21 No fix listed CWE-120
TI-2025-01190 CVE-2025-1386 · GHSA-m454-3xv7-qj85

Query smuggling in ch-go library

Priority LOW 27

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into…

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00401 Published 2025-04-11 Fixed in 0.65.0 CWE-444
TI-2024-15707 CVE-2024-23689 · GHSA-g8ph-74m6-8m7r

ClickHouse Client Certificate Password Exposure

Priority HIGH 73

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00676 Published 2024-01-19 Fixed in 0.4.6 CWE-209
TI-2023-25458 CVE-2023-47118

Heap buffer overflow in T64 codec decompression

Priority MEDIUM 42

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00462 Published 2023-12-20 Fixed in 23.3.16.7-lts CWE-122
TI-2021-19298 CVE-2021-43305 · GHSA-rjm8-hjq2-73j6

Heap-based buffer overflow in Yandex clickhouse

Priority MEDIUM 41

Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01672 Published 2022-03-14 Fixed in 21.10.2.15-stable CWE-122
TI-2021-19297 CVE-2021-43304 · GHSA-4px5-4p3v-7568

Heap-based buffer overflow in Yandex clickhouse

Priority MEDIUM 41

Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01672 Published 2022-03-14 Fixed in 21.10.2.15-stable CWE-122
TI-2021-18802 CVE-2021-42388 · GHSA-gg7g-5hm7-ggx5

Out-of-bounds read in Yandex clickhouse

Priority LOW 38

Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01573 Published 2022-03-14 Fixed in 21.10.2.15-stable CWE-125
TI-2021-18801 CVE-2021-42387 · GHSA-cf9g-639p-3wvv

Out-of-bounds read in Yandex clickhouse

Priority LOW 38

Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01573 Published 2022-03-14 Fixed in 21.10.2.15-stable CWE-125
TI-2019-11210 CVE-2019-15024 · GHSA-vv4f-6f99-x599

In all versions of ClickHouse before 19.14.3, an attacker having write access to…

Priority LOW 31

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious serv…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00949 Published 2019-12-30 No fix listed
TI-2019-12398 CVE-2019-16535 · GHSA-x3fg-74w9-f5r4

Out-of-bounds read in ClickHouse

Priority MEDIUM 45

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01695 Published 2019-12-30 No fix listed CWE-125
TI-2018-10535 CVE-2018-14672 · GHSA-2v23-4x7f-rh2c

Path traversal in ClickHouse

Priority LOW 28

In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01741 Published 2019-08-15 No fix listed CWE-22
Load more