CVE-2023-48298

    Dashboard / Vulnerabilities / CVE-2023-48298

    CVE-2023-48298

    Published: 21 Dec 2023Last Modified: 12 Aug 2026

    Summary: Integer underflow leading to stack overflow in FPC codec decompression

    Details: ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. This vulnerability is an integer underflow resulting in crash due to stack buffer overflow in decompression of FPC codec. It can be triggered and exploited by an unauthenticated attacker. The vulnerability is very similar to CVE-2023-47118 with how the vulnerable function can be exploited.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48298.json, https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-qw9f-qv29-8938, https://nvd.nist.gov/vuln/detail/CVE-2023-48298, https://github.com/ClickHouse/ClickHouse/pull/56795

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v23.3.16.7-lts
    v23.3.17.13-lts
    v23.3.15.29-lts
    v23.3.14.78-lts
    v23.3.13.6-lts
    v23.3.12.11-lts
    v23.3.11.5-lts
    v23.3.10.5-lts
    v23.3.9.55-lts
    v23.3.8.21-lts
    v23.3.7.5-lts
    v23.3.6.7-lts
    v23.3.5.9-lts
    v23.3.2.37-lts
    v23.3.4.17-lts
    v23.3.3.52-lts
    v23.3.1.2823-lts

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-48298 | CVE-DB