ClickHouse vulnerabilities
We track 8 vulnerabilities in ClickHouse products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest ClickHouse vulnerabilities
- 9.5 Critical severity
ClickHouse: Integer Overflow or Wraparound
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
- 7.5 High severity
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API…
When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse ta
- 8.1 High severity
ClickHouse: Heap-based Buffer Overflow
It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to the ClickHouse server native interface. This redirection is limited to what is available within a 2
- 8.8 High severity
Java Libraries: Generation of Error Message Containing Sensitive Information
Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and com.clickhouse:clickhouse-client versions less than 0.4.6 allows unauthorized users to gain access to client certificate passwords via client
- 7.5 High severity
ClickHouse: Out-of-bounds Write
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the nat
- 7.5 High severity
ClickHouse: Integer Underflow (Wrap or Wraparound)
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It c
- 9.8 Critical severity
ClickHouse: Out-of-bounds Write
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the na
- 7.5 High severity
Clickhouse: Out-of-bounds Write
An issue was discovered in ClickHouse before 22.9.1.2603. An attacker could send a crafted HTTP request to the HTTP Endpoint (usually listening on port 8123 by default), causing a heap-based buffer overflow that crashes the process. This does not require authe