ClickHouse vulnerabilities

CVEs per yearBy the year they were published

1. 20192
2. 20233
3. 20242
4. 20252
5. 20261

Newest CVEs

• CVE-2026-116366

  Unauthenticated RCE vulnerability against ClickHouse Server

  ClickHouse · ClickHouse

  Critical9.5
• CVE-2019-16536

  Stack overflow leading to DoS can be triggered by a malicious authenticated client.

  Clickhouse · DB

  High8.2
• CVE-2025-1385

  Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration

  ClickHouse · ClickHouse OSS

  High7.5
• CVE-2024-6873

  Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.

  ClickHouse · ClickHouse

  High8.1
• CVE-2024-22412

  ClickHouse's Role-based Access Control is bypassed when query caching is enabled.

  ClickHouse · ClickHouse

  Low2.4
• CVE-2023-48704

  Unauthenticated heap buffer overflow in Gorrila codec decompression

  ClickHouse · ClickHouse

  High7.0
• CVE-2023-48298

  Integer underflow leading to stack overflow in FPC codec decompression

  ClickHouse · ClickHouse

  Medium5.9
• CVE-2023-47118

  Heap buffer overflow in T64 codec decompression

  ClickHouse · ClickHouse

  High7.0
• CVE-2018-14671

  In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.

  ClickHouse · ClickHouse

  Critical9.8
• CVE-2018-14670

  Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.

  ClickHouse · ClickHouse

  Critical9.8