UpHeron
All vulnerabilities

Servers and applications

CVE-2019-16535

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.

Severity
Critical 9.8
Published
30 Dec 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
19.14
Exploit chance
1.7% in the next 30 daysHigher than 77% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
ClickHouseServers and applications · cpe:a:clickhouse:clickhouse
  • Every version before 19.14

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-16535
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-16535