Remote Code Execution and Denial of Service Vulnerability in ClickHouse by Yandex

CVE-2019-16535

What is CVE-2019-16535?

In all versions of ClickHouse before 19.14, vulnerabilities exist that enable out-of-bounds reading, out-of-bounds writing, and integer underflow within decompression algorithms. These weaknesses can be exploited to execute arbitrary code or trigger denial-of-service conditions through the native protocol, posing significant security risks to affected systems.

References