CVE-2023-47118 - CVE House
Back to Database
Status published High CVE-2023-47118

Heap buffer overflow in T64 codec decompression

Vulnerability Description

ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of T64 codec that crashes the ClickHouse server process. This attack does not require authentication. Note that this exploit can also be triggered via HTTP protocol, however, the attacker will need a valid credential as the HTTP authentication take places first. This issue has been fixed in version 23.10.2.13-stable, 23.9.4.11-stable, 23.8.6.16-lts and 23.3.16.7-lts.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-47118

Credits & Attribution

No credits recorded in the NVD database.

References

More from ClickHouse

View All →
CVE-2025-1385
Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration
High 7.5
CVE-2024-6873
Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.
High 8.1
CVE-2024-22412
ClickHouse's Role-based Access Control is bypassed when query caching is enabled.
Low 2.4
CVE-2023-48704
Unauthenticated heap buffer overflow in Gorrila codec decompression
High 7
CVE-2023-48298
Integer underflow leading to stack overflow in FPC codec decompression
Medium 5.9

Affected Vendor

Affected Software

ClickHouse
Vulnerable Versions:
< 23.3.16.7-lts

Timeline

Official Publish: December 20th, 2023
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Weaknesses (CWE)

CWE-122

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion