CVE-2025-1386: Query smuggling in ch-go library
Impact
When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.
Patches
If you are using ch-go library, we recommend you to update to at least version 0.65.0.
Credit
This issue was found by lixts and reported through our bugcrowd program.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1386?
CVE-2025-1386 is classified as a high-severity vulnerability due to its potential for query injection attacks.
How do I fix CVE-2025-1386?
To fix CVE-2025-1386, ensure to validate and sanitize all incoming query data to prevent injection.
What software is affected by CVE-2025-1386?
CVE-2025-1386 affects the ch-go library used in applications that interact with ClickHouse databases.
What is the impact of exploiting CVE-2025-1386?
Exploiting CVE-2025-1386 allows an attacker to smuggle another query packet, potentially leading to unauthorized data manipulation.
How can I identify if my system is vulnerable to CVE-2025-1386?
You can identify vulnerability to CVE-2025-1386 by reviewing your use of the ch-go library and checking for the presence of large, uncompressed external data in queries.