Vendor
ClickHouse
29 known vulnerabilities in products by ClickHouse, 1 of them actively exploited (CISA KEV).
Key figures
29
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder In CISA KEValso in 18 other products | 9.8 | |
| Critical | CVE-2018-14671 | ClickHouse: Remote Code Execution | 9.8 | |
| Critical | CVE-2026-116366 | Unauthenticated RCE vulnerability against ClickHouse Server | — | |
| Critical | CVE-2018-14670 | ClickHouse: security vulnerability | 9.8 | |
| Critical | CVE-2019-16535 | ClickHouse: Integer Underflow | 9.8 | |
| High | CVE-2021-43305 | Yandex Clickhouse: Heap-based Buffer Overflow | 8.8 | |
| High | CVE-2021-43304 | Yandex Clickhouse: Heap-based Buffer Overflow | 8.8 | |
| High | CVE-2021-42388 | Yandex Clickhouse: Out-of-bounds Read | 8.1 | |
| High | CVE-2021-42387 | Yandex Clickhouse: Out-of-bounds Read | 8.1 | |
| High | CVE-2018-14669 | ClickHouse: security vulnerability | 7.5 | |
| High | CVE-2019-16536 | Clickhouse DB: Classic Buffer Overflow | 8.8 | |
| Medium | CVE-2018-14672 | ClickHouse: Path Traversal | 5.3 | |
| Medium | CVE-2021-42391 | Yandex Clickhouse: Divide By Zero | 6.5 | |
| High | CVE-2022-44010 | ClickHouse: Heap-Based Buffer Overflow | 7.5 | |
| Medium | CVE-2021-42390 | Yandex Clickhouse: Divide By Zero | 6.5 | |
| Medium | CVE-2021-42389 | Yandex Clickhouse: Divide By Zero | 6.5 | |
| High | CVE-2024-23689 | ClickHouse Client Certificate Password Exposure | 8.8 | |
| Medium | CVE-2019-18657 | ClickHouse: security vulnerability | 5.3 | |
| High | CVE-2024-6873 | ClickHouse: Heap-based Buffer Overflow | 8.1 | |
| High | CVE-2018-14668 | ClickHouse: security vulnerability | 8.8 | |
| Medium | CVE-2019-15024 | ClickHouse: security vulnerability | 6.5 | |
| High | CVE-2024-41436 | ClickHouse: Buffer Overflow | 7.5 | |
| Medium | CVE-2022-44011 | ClickHouse: Heap-Based Buffer Overflow | 6.5 | |
| High | CVE-2025-1385 | ClickHouse OSS: Improper Input Validation | — | |
| High | CVE-2023-48298 | Integer underflow leading to stack overflow in FPC codec decompression | 5.9 |
News
- 2nd November – Threat Intelligence Reportcheckpoint-research,
- Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026cisco-psirt,
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emergesthehackernews,
- Node2Shell (CVE-2026-111497) in active exploitationsophos-xops,
- Node2Shell puts Microsoft and Node.js on Brotli patch dutycsoonline,
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flawthehackernews,
Products
| ClickHouse | 26 | 1 |
| ClickHouse Cloud | 5 | 0 |