Important Security Advisory for Altinity Builds of ClickHouse®

Dear Altinity customers and ClickHouse users. AI is putting a lot of pressure on software developers discovering bugs and potential vulnerabilities. ClickHouse is not an exception. Please upgrade as fast as possible to address recent discoveries:

• CVE-2026-111497 – a vulnerability involving the Brotli decoder, which is a third party dependency used by ClickHouse server and could allow tailored Brotli-compressed requests to cause ClickHouse server crashes. It affects all ClickHouse versions starting from 19.3.3
• CVE-2026-111943 and others – a compromise in certificate authority included in base Debian images used for ClickHouse server. 
• CVE-2026-116366 – ClickHouse server under certain conditions could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server. The CVE details are not going to be disclosed before November 13th.

First two problems were addressed in the following Antalya builds.

• 24.3.18.10427.altinitystable
• 24.8.14.10550.altinitystable
• 25.3.14.10002.altinitystable 
• 25.8.33.10002.altinitystable
• 25.8.33.20003.altinityantalya
• 26.3.60.10001.altinitystable
• 26.3.60.20001.altinityantalya
• 26.6.8.20003.altinityantalya – coming Nov 2nd.

We are working to address the latter one in a few days, so watch out for updates.

If you run upstream ClickHouse, the upgraded images for all issues are available in DockerHub, but releases were not officially published yet:

• 26.3.62.3
• 26.8.36.3
• 26.9.27.3
• 26.10.3.7

If you run ClickHouse software versions outside of this list, please upgrade to an upstream LTS or Altinity build to get the patch. 

We wish to thank the ClickHouse Inc. security team for communicating and sharing CVE fixes to ensure that all ClickHouse installations remain secure.