Skip to main content

Clickhouse CVE-2019-16536

HIGH
Classic Buffer Overflow (CWE-120)
2025-05-21 browser-security@yandex-team.ru
Buffer Overflow Clickhouse
8.2
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 18:43 vuln.today
CVE Published
May 21, 2025 - 08:15 nvd
HIGH 8.2

DescriptionCVE.org

Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.

AnalysisAI

Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3. Affected products include: Clickhouse. Version information: before 19.14.3.3..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.

More in Clickhouse

View all
CVE-2024-23689 HIGH POC
8.8 Jan 19

Exposure of sensitive information in exceptions in ClichHouse's clickhouse-r2dbc, com.clickhouse:clickhouse-jdbc, and co
CVE-2024-41436 HIGH POC
7.5 Sep 03

ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
CVE-2023-47118 CRITICAL
9.8 Dec 20

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports

CVE-2019-16535 CRITICAL
9.8 Dec 30

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can
CVE-2024-22412 MEDIUM POC
4.9 Mar 18

ClickHouse is an open-source column-oriented database management system. Rated medium severity (CVSS 4.9), this vulnerab
CVE-2023-48704 HIGH
7.5 Dec 22

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports i
CVE-2023-48298 HIGH
7.5 Dec 21

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports

CVE-2019-15024 MEDIUM
6.5 Dec 30

In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a cust
CVE-2025-1386 MEDIUM
5.9 Apr 11

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious externa
CVE-2019-18657 MEDIUM
5.3 Oct 31

ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function. Rated medium severity (CVSS 5.3),

Same weakness CWE-120 – Classic Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2019-11043 CRITICAL POC
9.8
CVE-2016-10174 CRITICAL POC
9.8
CVE-2016-0099 HIGH POC
7.8
CVE-2016-6366 HIGH POC
8.8
CVE-2013-1331 HIGH
7.8
CVE-2013-0641 HIGH
7.8
CVE-2017-15222 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

CVE-2019-16536 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy