PT-2025-16026 · Ch-Go · Ch-Go

Lixts · Published 2025-04-11 · Updated 2025-12-19 · CVE-2025-1386

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: ch-go library versions prior to 0.65.0

Description: The issue arises when the ch-go library is used under a specific condition where the query includes large, uncompressed malicious external data. This allows an attacker in control of such data to smuggle another query packet into the connection stream.

Recommendations: Update to at least version 0.65.0 to resolve the issue. As a temporary workaround, consider restricting the use of large, uncompressed external data in queries until the update is applied.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2025-1386

GHSA-M454-3XV7-QJ85

GO-2025-3603

OPENSUSE-SU-2025:15017-1

Affected Products

Ch-Go

References · 39

• https://github.com/ClickHouse/ch-go/security/advisories/GHSA-m454-3xv7-qj85 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m454-3xv7-qj85 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1386 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1386 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3603 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15017-1 · Vendor Advisory
• https://github.com/ClickHouse/ch-go/commit/0e835663df32b09b828528c07a5507686e6d975e · Note
• https://github.com/ClickHouse/ch-go · Note
• https://suse.com/security/cve/CVE-2025-32093 · Note
• https://suse.com/security/cve/CVE-2025-32445 · Note
• https://suse.com/security/cve/CVE-2025-27571 · Note
• https://t.me/cvetracker/21382 · Telegram Post
• https://t.me/cveNotify/146382 · Telegram Post
• https://t.me/cvedetector/22723 · Telegram Post
• https://suse.com/security/cve/CVE-2025-27936 · Note