Divide-by-Zero Vulnerability in Clickhouse's Gorilla Compression Codec

CVE-2021-42391

What is CVE-2021-42391?

A divide-by-zero vulnerability exists in Clickhouse's Gorilla compression codec, which occurs when parsing specially crafted queries. Specifically, the first byte of the compressed buffer is subjected to a modulo operation without verification, potentially leading to unexpected application behavior. This issue highlights the importance of implementing robust input validation measures to prevent manipulation through malicious queries.

References