ClickHouse Server has an integer overflow/wraparound in request parsing/validation that can be triggered remotely to corrupt bounds and reach a command injection sink, resulting in unauthenticated remote code execution under the clickhouse-server user. Not exploitable if the vulnerable endpoint is not exposed to untrusted networks.

Affects ClickHouse 26.3 < 26.3.62.3-lts, 26.8 < 26.8.36.3-lts, 26.9 < 26.9.27.3-stable, 26.10 < 26.10.3.7-stable; Upgrade to 26.3.62.3-lts / 26.8.36.3-lts / 26.9.27.3-stable / 26.10.3.7-stable (or later) to mitigate