UpHeron
All vulnerabilities

Servers and applications

CVE-2023-48704

Unauthenticated heap buffer overflow in Gorrila codec decompression

Severity
High 7.5
Published
18 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
23.3.18.15, 23.8.8.20, 23.9.2.47551, 23.9.6.20, 23.10.5.20
Also known as
GHSA-5rmf-5g48-xv63
Sources
NVD, Project advisories (GitHub)

Description

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the…

Affected software

SoftwareAffected versions
ClickHouseServers and applications · cpe:a:clickhouse:clickhouse
  • From 23.3 before 23.3.18.15
  • From 23.8 before 23.8.8.20
  • From 23.9 before 23.9.6.20
  • From 23.10 before 23.10.5.20
ClickHouseServers and applications · github:clickhouse/clickhouse
  • Every version before 23.10.5.20
  • Every version before 23.9.6.20
  • Every version before 23.8.8.20
  • Every version before 23.3.18.15
  • Every version before 23.9.2.47551

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-48704
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-48704
  • GitHub Advisory Database https://github.com/advisories/GHSA-5rmf-5g48-xv63
  • github.com https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5rmf-5g48-xv63