CVE-2025-1386

MEDIUM

ClickHouse ch-go < 0.65.0 - HTTP Request Smuggling via Malicious External Data

Title source: llm

Description

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.

References (1)

Core 1

Core References

Vendor Advisory

https://github.com/ClickHouse/ch-go/security/advisories/GHSA-m454-3xv7-qj85

Scores

CVSS v3 4.9

EPSS 0.0032

EPSS Percentile 23.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-444

Status published

Products (2)

clickhouse/ch < 0.65.0

ClickHouse/ch-go 0 - 0.65.0Go

Published Apr 11, 2025

Tracked Since Feb 18, 2026