CL
Product
Clickhouse
On CISA KEVExploited in the wild
24
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 5High 11Medium 8Low 0
Watch
Add Clickhouse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111497 In wildKEVNew | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder Affected: through 26.10.2.103 |
| CVE-2023-47118 | 9.8 | Dec 20 | ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time Affected: 23.3 before 23.3.16.7; 23.8 before 23.8.6.16; 23.9 before 23.9.4.11; 23.10 before 23.10.2.13 |
| CVE-2019-16535 | 9.8 | Dec 30 | In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol Affected: before 19.14 |
| CVE-2018-14671 | 9.8 | Aug 15 | In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability Affected: before 18.10.3 |
| CVE-2018-14670 | 9.8 | Aug 15 | Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database Affected: before 1.1.54131 |
| CVE-2019-16536 | 8.8 | May 21 | Stack overflow leading to DoS can be triggered by a malicious authenticated client. Affected: before 19.14.3.3 |
| CVE-2021-43305 | 8.8 | Mar 14 | Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2021-43304 | 8.8 | Mar 14 | Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2018-14668 | 8.8 | Aug 15 | In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery… Affected: before 1.1.54388 |
| CVE-2021-42388 | 8.1 | Mar 14 | Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2021-42387 | 8.1 | Mar 14 | Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2024-41436 | 7.5 | Sep 3 | ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl Affected: 24.3.3.102 |
| CVE-2023-48704 | 7.5 | Dec 22 | ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time Affected: 23.3 before 23.3.18.15; 23.8 before 23.8.8.20; 23.9 before 23.9.6.20; 23.10 before 23.10.5.20 |
| CVE-2023-48298 | 7.5 | Dec 21 | ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time Affected: 23.3 through 23.3.17.13; 23.8 through 23.8.7.24; 23.9 through 23.9.5.29; 23.10 through 23.10.4.25 |
| CVE-2022-44010 | 7.5 | Nov 23 | An issue was discovered in ClickHouse before 22.9.1.2603 Affected: before 22.3.12.19; 22.6 before 22.6.6.16; 22.7 before 22.7.4.16; 22.8 before 22.8.2.11; 22.9 before 22.9.1.2603 |
| CVE-2018-14669 | 7.5 | Aug 15 | ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the… Affected: before 1.1.54390 |
| CVE-2022-44011 | 6.5 | Nov 23 | An issue was discovered in ClickHouse before 22.9.1.2603 Affected: before 22.3.12.19; 22.6 before 22.6.6.16; 22.7 before 22.7.4.16; 22.8 before 22.8.2.11; 22.9 before 22.9.1.2603 |
| CVE-2021-42391 | 6.5 | Mar 14 | Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2021-42390 | 6.5 | Mar 14 | Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2021-42389 | 6.5 | Mar 14 | Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2019-15024 | 6.5 | Dec 30 | In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs,… Affected: before 19.14.3 |
| CVE-2019-18657 | 5.3 | Oct 31 | ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function Affected: before 19.13.5.44 |
| CVE-2018-14672 | 5.3 | Aug 15 | In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages Affected: before 18.12.13 |
| CVE-2024-22412 | 4.9 | Mar 18 | ClickHouse is an open-source column-oriented database management system Affected: 23.3.0.0 before 23.3.22.3; 23.8.0.0 before 23.8.12.13; 23.12.0.0 before 23.12.6.19; 24.0.0.0 before 24.1.1.2048 |
Showing 24