ClickHouse, Inc. maintains a focused analytical database platform and associated cloud services that has become prominent in large-scale data warehousing and real-time analytics workloads, despite a narrow product line. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes, concentrated in the core ClickHouse database engine and its Java integration libraries through recurring memory-safety weakness classes including out-of-bounds writes, heap-based buffer overflows, classic buffer overflows, and out-of-bounds reads. These flaws reflect the performance-oriented native-code architecture of a columnar storage engine operating on untrusted or complex query inputs. Defenders should monitor this vendor's releases closely for database instances and cloud deployments; live exploitation status and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by ClickHouse, Inc. over time
Of all the CVEs published by ClickHouse, Inc. as a CNA, 66.7% affect products that ClickHouse, Inc. develops as a vendor.
Of all the CVEs published that affect products developed by ClickHouse, Inc., 7.7% are self-published by ClickHouse, Inc. as a CNA.
Signals from CVEs in this vendor scope (26 CVEs).
26 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-14671CRITICAL In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability. | Aug 15, 2019 | 9.8 | 30 | NO | NO |
CVE-2021-43305HIGH Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and esp | Mar 14, 2022 | 8.8 | 29 | NO | NO |
CVE-2021-43304HIGH Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and esp | Mar 14, 2022 | 8.8 | 29 | NO | NO |
CVE-2019-16535CRITICAL In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol. | Dec 30, 2019 | 9.8 | 29 | NO | NO |
CVE-2018-14670CRITICAL Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. | Aug 15, 2019 | 9.8 | 29 | NO | NO |
CVE-2023-47118CRITICAL ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in | Dec 20, 2023 | 9.8 | 28 | NO | NO |
CVE-2021-42388HIGH Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('off | Mar 14, 2022 | 8.1 | 27 | NO | NO |
CVE-2021-42387HIGH Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('off | Mar 14, 2022 | 8.1 | 27 | NO | NO |
CVE-2024-23689HIGH Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allo | Jan 19, 2024 | 8.8 | 26 | NO | NO |
CVE-2018-14668HIGH In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protocol Request Forgery At | Aug 15, 2019 | 8.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (26 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by ClickHouse, Inc..
Media articles that mention a CVE ID that affects a product developed by ClickHouse, Inc. — matched by CVE ID, not by vendor name.