CVE-2023-48704

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120 CWE-122 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Dec 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-487055.4Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than CVE-2023-487064.7Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very fi CVE-2023-487076.5CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA CVE-2023-487086.5CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are rec CVE-2023-487098.0iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users' inputs may include m CVE-2023-48719.8A vulnerability classified as critical was found in SourceCodester Contact Manager App 1.0. This vulnerability affects unknown code of the f CVE-2023-487109.8iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they should have restricted CVE-2023-487113.7google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) Vuln CVE-2023-487128.8Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability t CVE-2023-487135.3Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker wh CVE-2023-487144.3Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1 CVE-2023-487155.4Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap Comm