CVE-2021-42387

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the upper bounds of the source of the copy operation.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
yandex	clickhouse	>= unspecified, < 21.10.2.15-stable

References

https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbmsExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00002.htmlMailing List, Third Party Advisory
https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbmsExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00002.htmlMailing List, Third Party Advisory

Timeline

Published: Mar 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-423888.1Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 1 CVE-2021-423896.5Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a CVE-2021-42397.5The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of ser CVE-2021-423906.5Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used CVE-2021-423916.5Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in CVE-2021-423929.8The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. CVE-2021-42405.3A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the CVE-2021-42415.3A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/ps CVE-2021-42428.8A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical. Affected by this issue is some unknown func CVE-2021-42446.1A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown pa CVE-2021-42459.8A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipu CVE-2021-42469.8A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the componen