CVE-2019-16535 - In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol

Back Back to CVE browser

CRITICAL

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol

Published Dec 30, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.70%

Description

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.

Affected products

Vendor n/a Product ClickHouse Default
unknown
Affected
- All versions prior to version 19.14.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	ClickHouse	unknown	Affected All versions prior to version 19.14.

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-125

Out-of-bounds Read

CWE-191

CWE-787

Out-of-bounds Write

References (2)

https://clickhouse.yandex/docs/en/security_changelog/
x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7209
Advisory

Link	Providers	Tags
https://clickhouse.yandex/docs/en/security_changelog/		x_refsource_MISCVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7209		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner yandex

Published Dec 30, 2019

Updated Aug 5, 2024

Reserved Sep 19, 2019

Link CVE-2019-16535

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-16535

Red Hat

No data

ENISA EUVD

Assigner yandex

Published Dec 30, 2019

Updated Aug 5, 2024

Link EUVD-2019-7209

GitHub

No data