Critical Severity
CVE-2026-116366
Published: Nov 2, 2026
PoC for CVE-2026-116366 — ClickHouse Server unauthenticated RCE (brotli v1.2.0 decoder out-of-bounds write): differential detector, weaponized DoS, containerized vulnerable-vs-fixed lab, root-cause analysis
# CVE-2026-116366 — ClickHouse Server Unauthenticated RCE (Brotli decoder OOB write)
[](LICENSE)
PoC, containerized lab, and root-cause analysis for **CVE-2026-116366**
(CVSS 4.0 **9.5 CRITICAL**, `AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`),
an unauthenticated remote code execution vulnerability in ClickHouse Server
caused by an out-of-bounds write in the bundled **Brotli decoder v1.2.0**
(the same root cause as [CVE-2026-111497](https://github.com/googlesky/CVE-2026-111497)).
| | |
|---|---|
| Affected (OSS) | 26.3 < 26.3.62.3-lts, 26.8 < 26.8.36.3-lts, 26.9 < 26.9.27.3-stable, 26.10 < 26.10.3.7-stable (default status: affected) |
| Fixed builds | v26.3.62.3-lts / v26.8.36.3-lts / v26.9.27.3-stable / v26.10.3.7-stable (2026-10-30) |
| Introduced | ClickHouse `a4e1ef85eb` (2026-09-09) — contrib `brotli` bump v1.0.9 → **v1.2.0** |
| Fixed by | ClickHouse `9f973a1aea` (2026-10-22) — contrib bump to **v1.2.1** (`b418fa81c4` "Detect and report invalid stream earlier") |
| CWE | CWE-190 (vendor record) — memory-safety class: OOB write |
| Reporter (to vendor) | Elshad Toklayev |
## Tổng quan
ClickHouse Server ≥ 26.3 (since the 2026-09-09 brotli bump) bundles brotli
**v1.2.0**, whose decoder mishandles an **illegal block switch**: a stream that
declares a single block type for literals/commands/distances and then requests
a block switch makes `DecodeBlockTypeAndLength()` fail — but the failure is
**indistinguishable from "needs more input"** and is silently discarded. The
decoder keeps running with corrupted state (`block_length == 0`, stale Huffman
tree pointers, broken ring-buffer position invariant), which produces:
1. an **out-of-bounds write** in the literal copy fast path of
`ProcessCommandsInternal()` (the `ringbuffer_size >= pos` guard is skipped
once `pos` runs out of range) — RCE-class, heap-layout dependent
(CVSS `AC:H`);
2. a **permanent 100%-CPU spin** in the decode