10 results · Feed
-
Critical 9.5CVE-2026-116366 Public exploit
Unauthenticated RCE vulnerability against ClickHouse Server
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
-
High 8.2
Stack overflow leading to DoS can be triggered by a malicious authenticated client.
Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.
-
High 7.5
ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
-
Low 2.4
ClickHouse's Role-based Access Control is bypassed when query caching is enabled.
ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls an…
-
Unscored —
An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability to load data) could c…
-
Unscored —
An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP End…
-
Unscored —
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decom…
-
Unscored —
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decom…
-
Unscored —
Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification tha…
-
Unscored —
Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification tha…