CVE-2022-44010

What it actually does

A heap-based buffer overflow in the unauthenticated HTTP endpoint (default port 8123) allows a crafted request to overwrite memory and terminate the ClickHouse process, producing a denial-of-service condition with no confidentiality or integrity impact.

Why it matters to the business

Remote unauthenticated attackers can crash the database service at will, causing unplanned outages for analytics and data workloads; the issue has been public for nearly three years, carries low exploitation probability, and affects any organization running an unpatched ClickHouse deployment.

How an attack unfolds

An attacker locates the ClickHouse HTTP interface, crafts a malicious request that triggers the buffer overflow, and sends it without credentials; the server process crashes, requiring a restart to restore service.

How to fix it

Upgrade to ClickHouse 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, or 22.3.12.19, or apply commit 0b9272f8fdc8052d86f445be302b137b7d30e842 in the affected Git repository; restrict network access to the HTTP port until patched.

How to confirm the fix worked

Confirm the running binary reports a fixed version string; replay a known-safe malformed request against a test instance and verify the process remains stable.

Typical attack path

1. Discover ClickHouse HTTP endpoint listening on TCP 8123
2. Send a single specially crafted HTTP request containing the triggering payload
3. Observe immediate process termination and service unavailability

How to detect it

Review system and application logs for abrupt ClickHouse process terminations correlated with inbound HTTP traffic on port 8123; examine access logs for unusually large or malformed request lines.

What your security team should do

• Apply one of the listed fixed versions immediately
• Place the HTTP endpoint behind an allow-list or reverse proxy
• Add process crash and restart alerts for the ClickHouse service