What’s Vulnerable › Vulnerabilities

CVE-2019-16535

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-12-30 · updated 2026-06-17
• Weakness: CWE-125

Description

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.

Affected products

• ClickHouse: before 19.14 — fixed in 19.14

How to fix

Upgrade to a fixed version: ClickHouse 19.14. Check the vendor advisory for mitigations.

References

• https://clickhouse.yandex/docs/en/security_changelog/
• https://clickhouse.yandex/docs/en/security_changelog/

Get alerted when CVE-2019-16535 or the next vulnerability affects your stack