Arbitrary code execution in clickhouse-driver

CRITICAL 9.8CVE-2020-26759 · BIT-clickhouse-2020-26759 · GHSA-vgv5-cxvh-vfxh · Published 06/01/2021 · updated 17/06/2026

In short

CVE-2020-26759 is a CRITICAL (CVSS 9.8) vulnerability affecting clickhouse-driver, clickhouse-driver (clickhouse-driver project).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 86.0% of all vulnerabilities.
Fix: update to 0.1.5 or later.

Package	Affected versions	Patched versions
clickhouse-driver PyPI	`< 0.1.5`	`0.1.5`
clickhouse-driver clickhouse-driver_project	`< 0.1.5`	`0.1.5`

Description

clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.

NVD description

clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.

References

nvd.nist.gov/vuln/detail/CVE-2020-26759 · ADVISORY
mymarilyn/clickhouse-driver commit 3e99054 · WEB
mymarilyn/clickhouse-driver commit d708ed5 · WEB
GitHub Advisory GHSA-vgv5-cxvh-vfxh · ADVISORY
mymarilyn/clickhouse-driver · PACKAGE
pypa/advisory-database · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free