CVE catalog
CVE-2023-48298
clickhouse: CVE-2023-48298
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.63% · Oct 25, 2026
ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | clickhouse | bookworm | 18.16.1+ds-7.3 | not affected |
| Ubuntu | clickhouse | 20.04 | 18.16.1+ds-5 | vulnerable |
| Ubuntu | clickhouse | 20.04 | 18.16.1+ds-5ubuntu1 | vulnerable |
| Ubuntu | clickhouse | 20.04 | 18.16.1+ds-5ubuntu2 | vulnerable |
| Ubuntu | clickhouse | 20.04 | 18.16.1+ds-6ubuntu1 | vulnerable |
| Ubuntu | clickhouse | 20.04 | 18.16.1+ds-7 | vulnerable |
| Ubuntu | clickhouse | 20.04 | 18.16.1+ds-7ubuntu0.1 | vulnerable |
| Ubuntu | clickhouse | 24.04 | 18.16.1+ds-7.4 | vulnerable |
| Ubuntu | clickhouse | 24.04 | 18.16.1+ds-7.4build1 | vulnerable |
| Ubuntu | clickhouse | 24.04 | 18.16.1+ds-7.4build2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | clickhouse | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.