CVE-2023-48704— Unauthenticated heap buffer overflow in Gorrila codec decompression
Quick assessment
Affected
ClickHouse ClickHouse
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ClickHouse是ClickHouse公司的用于实时应用程序和分析的速度最快、资源效率最高的开源数据库。 ClickHouse 存在安全漏洞，该漏洞源于攻击者可以将特制的有效负载发送到端口 9000/tcp 上公开的本机接口，从而触发 Gorilla 编解码器的解压缩逻辑中的错误，从而导致 ClickHouse 服务器进程崩溃，以下产品和版本受到影响：ClickHouse Cloud 23.9.2.47551 之前版本和 ClickHouse 23.10.5.20之前、23.3.18.15之前、23.
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-48704
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated heap buffer overflow in Gorrila codec decompression
Source: CVE Program / CVE List V5
Vulnerability Description
ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
ClickHouse 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ClickHouse是ClickHouse公司的用于实时应用程序和分析的速度最快、资源效率最高的开源数据库。 ClickHouse 存在安全漏洞，该漏洞源于攻击者可以将特制的有效负载发送到端口 9000/tcp 上公开的本机接口，从而触发 Gorilla 编解码器的解压缩逻辑中的错误，从而导致 ClickHouse 服务器进程崩溃，以下产品和版本受到影响：ClickHouse Cloud 23.9.2.47551 之前版本和 ClickHouse 23.10.5.20之前、23.3.18.15之前、23.
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ClickHouse | ClickHouse | < 23.9.2.47551 | - |
|
II. Public POCs for CVE-2023-48704
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-48704
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-48704 (1)
-
https://github.com/ClickHouse/ClickHouse/pull/57107 x_refsource_MISC
Vendor Advisories for CVE-2023-48704 (1)
-
https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5rmf-5g48-xv63 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: ClickHouse
-
CVE-2024-6873
Specially crafted request could caused undefined behaviour w -
CVE-2024-22412
ClickHouse's Role-based Access Control is bypassed when quer -
CVE-2023-48298
Integer underflow leading to stack overflow in FPC codec dec -
CVE-2023-47118
Heap buffer overflow in T64 codec decompression -
CVE-2021-42391
Yandex ClickHouse 数字错误漏洞
Same vendor: ClickHouse
-
CVE-2019-16536
Stack overflow leading to DoS can be triggered by a maliciou -
CVE-2025-1385
Fail input validation in clickhouse-library-bridge API could -
CVE-2024-6873
Specially crafted request could caused undefined behaviour w -
CVE-2024-22412
ClickHouse's Role-based Access Control is bypassed when quer -
CVE-2023-48298
Integer underflow leading to stack overflow in FPC codec dec
Same weakness: CWE-122
-
CVE-2026-103631
Chrome <154.0.8037.97 WebRTC堆溢出漏洞 -
CVE-2026-91135
Apache Thrift: C++ `THeaderTransport::transform()` heap buff -
CVE-2026-14316
Heap buffer overflow in boks_sshd revoked-key error handling -
CVE-2026-101283
iperf3 3.20-3.21 RSA解密堆溢出漏洞 -
CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mi
V. Comments for CVE-2023-48704
No comments yet