Skip to content
Noroxi

ClickHouse records

25 published records for vendor clickhouse.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
28%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

25 records
  • CVE-2018-14671
    40Plan

    In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vu

    CriticalCVSS 9.8No exploitEPSS 3%

    clickhouse · clickhouseAug 15, 2019

  • CVE-2018-14670
    40Plan

    Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.

    CriticalCVSS 9.8No exploitEPSS 1%

    clickhouse · clickhouseAug 15, 2019

  • CVE-2019-16535
    40Plan

    In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve

    CriticalCVSS 9.8No exploitEPSS 1%

    clickhouse · clickhouseDec 30, 2019

  • CVE-2023-47118
    39Monitor

    Heap buffer overflow in T64 codec decompression

    CriticalCVSS 9.8No exploitEPSS 0%

    clickhouse · clickhouseDec 20, 2023

  • CVE-2021-43304
    36Monitor

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.

    HighCVSS 8.8No exploitEPSS 1%

    clickhouse · clickhouseMar 14, 2022

  • CVE-2021-43305
    36Monitor

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query.

    HighCVSS 8.8No exploitEPSS 1%

    clickhouse · clickhouseMar 14, 2022

  • CVE-2018-14668
    35Monitor

    In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which

    HighCVSS 8.8No exploitEPSS 0%

    clickhouse · clickhouseAug 15, 2019

  • CVE-2024-23689
    35Monitor

    ClickHouse Client Certificate Password Exposure

    HighCVSS 8.8No exploitEPSS 0%

    clickhouse · java librariesJan 19, 2024

  • CVE-2021-42387
    32Monitor

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.

    HighCVSS 8.1No exploitEPSS 1%

    clickhouse · clickhouseMar 14, 2022

  • CVE-2021-42388
    32Monitor

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query.

    HighCVSS 8.1No exploitEPSS 1%

    clickhouse · clickhouseMar 14, 2022

  • CVE-2019-16536
    32Monitor

    Stack overflow leading to DoS can be triggered by a malicious authenticated client.

    HighCVSS 8.2No exploitEPSS 0%

    clickhouse · clickhouseMay 21, 2025

  • CVE-2018-14669
    31Monitor

    ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database

    HighCVSS 7.5No exploitEPSS 1%

    clickhouse · clickhouseAug 15, 2019

  • CVE-2022-44010
    30Monitor

    An issue was discovered in ClickHouse before 22.9.1.2603.

    HighCVSS 7.5No exploitEPSS 0%

    clickhouse · clickhouseNov 23, 2023

  • CVE-2023-48298
    30Monitor

    Integer underflow leading to stack overflow in FPC codec decompression

    HighCVSS 7.5No exploitEPSS 0%

    clickhouse · clickhouseDec 21, 2023

  • CVE-2024-41436
    30Monitor

    ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.

    HighCVSS 7.5No exploitEPSS 0%

    clickhouse · clickhouseSep 3, 2024

  • CVE-2023-48704
    30Monitor

    Unauthenticated heap buffer overflow in Gorrila codec decompression

    HighCVSS 7.5No exploitEPSS 0%

    clickhouse · clickhouseDec 22, 2023

  • CVE-2021-42391
    26Monitor

    Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query.

    MediumCVSS 6.5No exploitEPSS 1%

    clickhouse · clickhouseMar 14, 2022

  • CVE-2021-42390
    26Monitor

    Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query.

    MediumCVSS 6.5No exploitEPSS 1%

    clickhouse · clickhouseMar 14, 2022

  • CVE-2021-42389
    26Monitor

    Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query.

    MediumCVSS 6.5No exploitEPSS 1%

    clickhouse · clickhouseMar 14, 2022

  • CVE-2019-15024
    26Monitor

    In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available

    MediumCVSS 6.5No exploitEPSS 0%

    clickhouse · clickhouseDec 30, 2019

  • CVE-2022-44011
    26Monitor

    An issue was discovered in ClickHouse before 22.9.1.2603.

    MediumCVSS 6.5No exploitEPSS 0%

    clickhouse · clickhouseNov 23, 2023

  • CVE-2025-1386
    23Monitor

    Query smuggling in ch-go library

    MediumCVSS 5.9No exploitEPSS 0%

    clickhouse · chApr 11, 2025

  • CVE-2018-14672
    22Monitor

    In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messag

    MediumCVSS 5.3No exploitEPSS 1%

    clickhouse · clickhouseAug 15, 2019

  • CVE-2019-18657
    21Monitor

    ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.

    MediumCVSS 5.3No exploitEPSS 1%

    clickhouse · clickhouseOct 31, 2019

  • CVE-2024-22412
    19Monitor

    ClickHouse's Role-based Access Control is bypassed when query caching is enabled.

    MediumCVSS 4.9No exploitEPSS 0%

    clickhouse · clickhouseMar 18, 2024