Introduction
ClickHouse is a widely deployed, high-performance columnar database management system designed for online analytical processing (OLAP). To maintain its exceptional read and write speeds, ClickHouse relies heavily on efficient data compression algorithms, including Google’s Brotli library. CVE-2026-116366 represents a critical security flaw in how ClickHouse handles incoming Brotli-compressed payloads. This vulnerability exposes affected servers to unauthenticated Remote Code Execution (RCE) and Denial of Service (DoS) attacks via memory corruption. As data architectures increasingly expose ingestion endpoints to wider networks for real-time analytics, vulnerabilities at the transport and decompression layers become highly attractive targets. Threat actors actively scan for exposed ClickHouse instances to exploit these low-level memory handling errors, bypassing application-level security controls entirely.
Learning Objectives
By the end of this analysis, readers will be able to:
- Understand the core components and origins of CVE-2026-116366.
- Analyze the technical mechanics of the Out-Of-Bounds (OOB) write vulnerability within the Brotli decoder.
- Identify the specific attack vectors and network ports exploited by threat actors.
- Determine if their infrastructure, including embedded analytics stacks, is running vulnerable software.
- Apply appropriate remediation and network segmentation strategies to secure ClickHouse deployments.
What is ClickHouse Server – Brotli v1.2.0 Decoder DoS/OOB-Write (CVE-2026-116366)
CVE-2026-116366 is a critical vulnerability (CVSS 9.5) specific to ClickHouse Server, stemming from an underlying flaw in the bundled Google Brotli compression library (tracked upstream as CVE-2026-111497). Because ClickHouse natively accepts compressed data over its network interfaces to optimize data ingestion rates and reduce bandwidth, it routinely passes external, untrusted data streams directly to the Brotli C decoder. The core of the issue manifests when an unauthenticated attacker sends a maliciously crafted, Brotli-compressed payload directly to the ClickHouse server’s listening ports. Upon decompression, an out-of-bounds (OOB) write occurs, severely corrupting server memory. This corruption reliably results in an immediate crash of the ClickHouse daemon, creating a catastrophic Denial of Service (DoS) condition for data pipelines. Beyond simple service disruption, highly sophisticated threat actors can manipulate this heap memory corruption to achieve arbitrary code execution. By carefully structuring the out-of-bounds write to overwrite critical function pointers or execution flows, the attacker gains the ability to run malicious commands with the full operating system privileges of the ClickHouse database process, leading to total server compromise.
- CVSS Severity: 9.5 (Critical) reflecting the lack of authentication required.
- Attack Vector: Network-based exploitation targeting default database ingestion ports.
- Underlying Flaw: Inherited directly from Google’s Brotli C library versions 1.0.3 through 1.2.0.
- Primary Impacts: Denial of Service (DoS) via process crash and unauthenticated Remote Code Execution (RCE).
[Attacker] --(Crafted Brotli Payload)--> [Network Port 8123/9000]
|
v
[ClickHouse Ingestion Layer]
|
v
[Brotli C Decoder Module]
|
v
[Out-of-Bounds Memory Write]
|
+------------+------------+
| |
v v
[Process Crash (DoS)] [Remote Code Execution]
Technical Detail: How the Vulnerability Works
The root cause of this memory corruption lies within the C implementation of the Brotli decoder, specifically localized to the DecodeBlockTypeAndLength() function found within the c/dec/decode.c source file. When the Brotli decoder processes an incoming stream, it relies heavily on block switches to accurately manage different data types and their corresponding lengths. The vulnerability is explicitly triggered when this function encounters a malformed or structurally invalid block switch designed by an attacker. Instead of safely terminating the decoding process or throwing a handled exception upon encountering this invalid structure, the function yields an ambiguous return value. The critical failure occurs because the Brotli fast decoding path aggressively prioritizes speed and fails to validate this anomalous state. As the decoder continues processing the payload under demonstrably false assumptions about block lengths and boundary limits, it blindly writes the decompressed output.
Consequently, the decoder writes this output directly past the strictly enforced boundaries of its allocated heap memory buffer. In the context of ClickHouse, this OOB write is exceptionally dangerous because the decompression occurs synchronously as data streams in from the network interfaces. An attacker exploits this by simply delivering the payload over the default HTTP (8123) or Native (9000) ports before the database ever attempts to parse the content as a legitimate SQL query.
- Vulnerable Function:
DecodeBlockTypeAndLength()located withinc/dec/decode.c. - Trigger Mechanism: Intentional injection of malformed block switches within the compressed HTTP/TCP stream.
- Validation Failure: The fast decoding path ignores ambiguous return values from the underlying block parser.
- Exploitation Phase: Memory overwrite occurs during synchronous network stream decompression prior to SQL parsing.
Affected Software & Plugins
The vulnerability directly impacts self-hosted environments running ClickHouse Server versions that statically or dynamically bundle Brotli library versions ranging from 1.0.3 through 1.2.0. Because ClickHouse is heavily integrated into modern data architectures, the attack surface extends beyond standalone database clusters. Administrators must account for bare-metal, containerized, and orchestrated Kubernetes deployments running older, unpatched releases of the database software. Furthermore, organizations are frequently exposed unknowingly if they operate self-hosted software platforms that silently bundle ClickHouse as their underlying telemetry, logging, or data storage backend. Many open-source analytics stacks provide default deployment configurations that pull vulnerable ClickHouse container images, meaning security teams must audit their entire application dependency chain, not just the primary database servers.
- Standalone Deployments: Bare-metal servers and Docker/Kubernetes clusters running unpatched ClickHouse builds.
- Embedded Analytics: Self-hosted platforms like Langfuse, Plausible Analytics, or PostHog that utilize bundled ClickHouse containers.
- Monitoring Stacks: Self-hosted Sentry or custom observability pipelines utilizing ClickHouse for extensive log aggregation.
- Client Applications: Data processing drivers that ingest heavily compressed upstream data, potentially exposing client-side decoders.
Conclusion
CVE-2026-116366 emphatically highlights the persistent and systemic danger of memory safety vulnerabilities lurking within foundational C/C++ compression libraries. When these low-level libraries are integrated into high-performance, network-facing applications like ClickHouse, the security implications are magnified drastically. The CVSS score of 9.5 accurately reflects the severity of this threat, given that exploitation requires zero authentication and directly targets the default, often exposed, network ingestion ports. Immediate and comprehensive remediation requires upgrading ClickHouse to a fully patched release, such as version 26.3.62.3-lts or the latest stable iterative build provided by the vendor. Security and operations teams must prioritize these upgrades across all environments, ensuring that embedded analytics containers and third-party dashboards relying on ClickHouse are also rebuilt with secure images. Relying solely on perimeter defenses is insufficient if internal threat actors or lateral movement capabilities exist within the corporate network. In the interim, or in environments where immediate patching is operationally unfeasible, administrators must enforce strict network segmentation protocols. Database ports should be bound exclusively to localhost (127.0.0.1) or highly restricted internal VPC subnets. Implementing aggressive firewall rules to unconditionally block public internet access to ports 8123, 8443, 9000, and 9440 is a mandatory defensive posture to mitigate external exploitation attempts until patches are permanently applied.
The Brotli library is frequently used not only in ClickHouse but also in popular servers like Nginx and Apache. However, it is important to note that this vulnerability is particularly critical in the case of ClickHouse due to its architecture for synchronous data processing.