CVE-2019-16535

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via native protocol.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125 CWE-191 CWE-787

Affected software

Vendor	Product	Versions
n/a	ClickHouse	All versions prior to version 19.14.

References

https://clickhouse.yandex/docs/en/security_changelog/Vendor Advisory
https://clickhouse.yandex/docs/en/security_changelog/Vendor Advisory

Timeline

Published: Dec 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-165368.8Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.CVE-2019-165388.8A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions i CVE-2019-165396.5A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support b CVE-2019-16547.8A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS ope CVE-2019-165406.5A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbit CVE-2019-165419.9Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to s CVE-2019-165426.5Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins mast CVE-2019-165435.5Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where CVE-2019-165448.8Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins mast CVE-2019-165456.5Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms CVE-2019-165465.9Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling CVE-2019-165474.3Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Re