CVE-2020-26759: Arbitrary code execution in clickhouse-driver
Summary
CVE-2020-26759: Arbitrary code execution in clickhouse-driver. Affects clickhouse-driver versions < 0.1.5. Fixed in 0.1.5. How to fix ↓
Also tracked for
- clickhouse · Bitnami
- python-clickhouse-driver · Debian:11
The same CVE-2020-26759 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
clickhouse-driver is a Python package that provides a client library for interacting with ClickHouse, an open-source column-oriented database management system. It allows users to connect to a ClickHouse server and execute queries. The vulnerability identified as CVE-2020-26759 can be exploited by a malicious ClickHouse server to trigger a crash or execute arbitrary code on a client machine. This vulnerability arises due to a buffer overflow in clickhouse-driver before version 0.1.5.
Vulnerability Detail
The vulnerability in clickhouse-driver allows a malicious ClickHouse server to send a specially crafted response that triggers a buffer overflow on the client-side. This can lead to a crash of the client application or enable the execution of arbitrary code. The buffer overflow occurs in the following functions: clickhouse_driver.bufferedreader.BufferedReader, clickhouse_driver.bufferedreader.BufferedReader.read, clickhouse_driver.bufferedreader.BufferedReader.read_strings, clickhouse_driver.bufferedwriter.BufferedWriter, clickhouse_driver.bufferedwriter.BufferedWriter.init, and clickhouse_driver.bufferedwriter.BufferedWriter.write. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How To Fix
Latest published version: 0.2.11 as of 22 Oct 2026
pip install --upgrade "clickhouse-driver==0.2.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.5
This is the first release that contains the fix.
pip install --upgrade "clickhouse-driver==0.1.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of clickhouse-driver to ensure the security of the application.
Conclusion
The vulnerability in clickhouse-driver (CVE-2020-26759) exposes users to the risk of arbitrary code execution or application crashes. To mitigate this risk, it is essential to upgrade to clickhouse-driver version 0.1.5 or later. This upgrade includes the necessary patches to prevent the buffer overflow. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for clickhouse-driver →
FAQ
clickhouse-driver is a Python package that provides a client library for interacting with ClickHouse, an open-source column-oriented database management system.
This vulnerability allows a malicious ClickHouse server to crash the client application or execute arbitrary code on the client machine.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
To fix this vulnerability, it is recommended to upgrade clickhouse-driver to version 0.1.5 or later.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of clickhouse-driver.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
