CVE-2021-42388: clickhouse Out-of-bounds Read
Vulnerability summary
CVE-2021-42388 is a high (CVSS 8.1) Out-of-bounds Read vulnerability in clickhouse. EPSS estimates a 1.57% chance of exploitation in the next 30 days, higher than 75.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 14-03-2022PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from the compressed data. The offset is later used in the length of a copy operation, without checking the lower bounds of the source of the copy operation.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
1.57%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.57% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (jfrog.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- clickhouse< 18.16.1+ds-7.3
- debian_linuxEOL10.0
Clickhouse1 product
- clickhouse< 21.10.2.15
Ubuntu1 product
- clickhouse< 18.16.1+ds-7ubuntu0.1
Yandex1 product
- clickhouse≥ unspecified, < 21.10.2.15-stable
4 vendors · 5 products
