Vulnerability Analysis: CVE-2026-116366 ClickHouse Server – Brotli v1.2.0 Decoder DoS/OOB-Write
Introduction ClickHouse is a widely deployed, high-performance columnar database management system designed for online analytical processing (OLAP). To maintain its exceptional read and write speeds, ClickHouse relies heavily on efficient data compression algorithms, including Google’s Brotli library. CVE-2026-116366 represents a critical security flaw in how ClickHouse handles incoming Brotli-compressed payloads. This vulnerability exposes affected servers to unauthenticated Remote Code Execution (RCE) and Denial of