CVE Program partner

ClickHouse

ClickHouse, Inc.

API
CVEs, 365 days03 all time, 0 rejected
Quality-median 99%
CVSS by the CNA-share of records
CWE-share of records
Affected versions-not n/a or unspecified
CVSS added by CISA-lower is better
OrganisationClickHouse, Inc.
RoleCNA
TypeVendor, Open Source
Reports tomitre
ScopeClickHouse-owned products, not including end-of-life components.
Advisorieshttps://clickhouse.com/docs/en/whats-new/security-changelog

Latest CVEs · RSS

  • CVE-2025-1386 2025-04-11 · CVSS 5.9
    When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker i
  • CVE-2025-1385 2025-03-20 · CVSS 7.5
    When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a
  • CVE-2024-6873 2024-08-01 · CVSS 8.1
    It is possible to crash or redirect the execution flow of the ClickHouse server process from an unauthenticated vector by sending a specially crafted request to

All CVE Program partners