CL
Product
ClickHouse
On CISA KEVExploited in the wild
25
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 5High 12Medium 8Low 0
Watch
Add ClickHouse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-16536 | 8.8 | May 21 | Stack overflow leading to DoS can be triggered by a malicious authenticated client. Affected: before 19.14.3.3 |
| CVE-2021-43305 | 8.8 | Mar 14 | Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2021-43304 | 8.8 | Mar 14 | Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2018-14668 | 8.8 | Aug 15 | In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery… Affected: before 1.1.54388 |
| CVE-2024-6873 | 8.1 | Aug 1 | Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution. Affected: v23.8.0 before v23.8.15.35-lts; v24.3.0 before v24.3.4.147-lts; v24.4.0 before v24.4.2.141-stable; v24.5.0 before v24.5.1.1763; v24.6.0 before v24.6.1.4423-stable |
| CVE-2021-42388 | 8.1 | Mar 14 | Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2021-42387 | 8.1 | Mar 14 | Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query Affected: before 21.10.2.15 |
| CVE-2024-41436 | 7.5 | Sep 3 | ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl Affected: 24.3.3.102 |
| CVE-2023-48704 | 7.5 | Dec 22 | ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time Affected: 23.3 before 23.3.18.15; 23.8 before 23.8.8.20; 23.9 before 23.9.6.20; 23.10 before 23.10.5.20 |
| CVE-2023-48298 | 7.5 | Dec 21 | ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time Affected: 23.3 through 23.3.17.13; 23.8 through 23.8.7.24; 23.9 through 23.9.5.29; 23.10 through 23.10.4.25 |
| CVE-2022-44010 | 7.5 | Nov 23 | An issue was discovered in ClickHouse before 22.9.1.2603 Affected: before 22.3.12.19; 22.6 before 22.6.6.16; 22.7 before 22.7.4.16; 22.8 before 22.8.2.11; 22.9 before 22.9.1.2603 |
| CVE-2018-14669 | 7.5 | Aug 15 | ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the… Affected: before 1.1.54390 |
Showing 12