CVE-2021-42390

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-369

Affected software

Vendor	Product	Versions
yandex	clickhouse	>= unspecified, < 21.10.2.15-stable

References

https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbmsExploit, Third Party Advisory
https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbmsExploit, Third Party Advisory

Timeline

Published: Mar 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-423916.5Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in CVE-2021-423929.8The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. CVE-2021-42405.3A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function generatePasswordResetToken of the CVE-2021-42415.3A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/ps CVE-2021-42428.8A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical. Affected by this issue is some unknown func CVE-2021-42446.1A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown pa CVE-2021-42459.8A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipu CVE-2021-42469.8A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the componen CVE-2021-42477.5A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/rout CVE-2021-42489.8A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality CVE-2021-42497.5A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src CVE-2021-42507.5A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2. This affects the function call of the file lib