CL
Vendor
Clickhouse
32
CVEs
1
On KEV
1
New 30D
Products
CL9.8
Clickhouse
Clickhouse
24 CVEs1 on KEV1 new
CC9.8
Clickhouse Cloud
Clickhouse
4 CVEs0 on KEV0 new
CH4.9
CH
Clickhouse
1 CVEs0 on KEV0 new
CO7.5
ClickHouse OSS
ClickHouse
1 CVEs0 on KEV0 new
DB8.8
DB
Clickhouse
1 CVEs0 on KEV0 new
JL8.8
Java Libraries
Clickhouse
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111497 In wildKEVNew | CL Clickhouse Clickhouse | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder |
| CVE-2019-16536 | DB DB Clickhouse | 8.8 | May 21 | Stack overflow leading to DoS can be triggered by a malicious authenticated client. |
| CVE-2025-1386 | CH CH Clickhouse | 4.9 | Apr 11 | Query smuggling in ch-go library |
| CVE-2025-1385 | CO ClickHouse OSS ClickHouse | 7.5 | Mar 20 | Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration |
| CVE-2024-41436 | CL Clickhouse Clickhouse | 7.5 | Sep 3 | ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl |
| CVE-2024-22412 | CC Clickhouse Cloud Clickhouse | 4.9 | Mar 18 | ClickHouse is an open-source column-oriented database management system |
| CVE-2024-23689 | JL Java Libraries Clickhouse | 8.8 | Jan 19 | Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6… |
| CVE-2023-48704 | CL Clickhouse Clickhouse | 7.5 | Dec 22 | ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time |
| CVE-2023-48298 | CL Clickhouse Clickhouse | 7.5 | Dec 21 | ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time |
| CVE-2023-47118 | CC Clickhouse Cloud Clickhouse | 9.8 | Dec 20 | ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time |
| CVE-2022-44011 | CL Clickhouse Clickhouse | 6.5 | Nov 23 | An issue was discovered in ClickHouse before 22.9.1.2603 |
| CVE-2022-44010 | CL Clickhouse Clickhouse | 7.5 | Nov 23 | An issue was discovered in ClickHouse before 22.9.1.2603 |
| CVE-2021-43305 | CL Clickhouse Clickhouse | 8.8 | Mar 14 | Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query |
| CVE-2021-43304 | CL Clickhouse Clickhouse | 8.8 | Mar 14 | Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query |
| CVE-2021-42391 | CL Clickhouse Clickhouse | 6.5 | Mar 14 | Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query |
| CVE-2021-42390 | CL Clickhouse Clickhouse | 6.5 | Mar 14 | Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query |
| CVE-2021-42389 | CL Clickhouse Clickhouse | 6.5 | Mar 14 | Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query |
| CVE-2021-42388 | CL Clickhouse Clickhouse | 8.1 | Mar 14 | Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query |
| CVE-2021-42387 | CL Clickhouse Clickhouse | 8.1 | Mar 14 | Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query |
| CVE-2019-16535 | CL Clickhouse Clickhouse | 9.8 | Dec 30 | In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol |
| CVE-2019-15024 | CL Clickhouse Clickhouse | 6.5 | Dec 30 | In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs,… |
| CVE-2019-18657 | CL Clickhouse Clickhouse | 5.3 | Oct 31 | ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function |
| CVE-2018-14672 | CL Clickhouse Clickhouse | 5.3 | Aug 15 | In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages |
| CVE-2018-14671 | CL Clickhouse Clickhouse | 9.8 | Aug 15 | In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability |
| CVE-2018-14670 | CL Clickhouse Clickhouse | 9.8 | Aug 15 | Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database |
| CVE-2018-14669 | CL Clickhouse Clickhouse | 7.5 | Aug 15 | ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary files from the… |
| CVE-2018-14668 | CL Clickhouse Clickhouse | 8.8 | Aug 15 | In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery… |