When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.
References
| Link | Resource |
|---|---|
| https://github.com/ClickHouse/ch-go/security/advisories/GHSA-m454-3xv7-qj85 | Vendor Advisory |
Configurations
History
19 Dec 2025, 18:47
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:clickhouse:ch:*:*:*:*:*:go:*:* | |
| First Time |
Clickhouse
Clickhouse ch |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.9 |
| References | () https://github.com/ClickHouse/ch-go/security/advisories/GHSA-m454-3xv7-qj85 - Vendor Advisory | |
| Summary | (es) Al utilizar la librería ch-go, bajo una condición específica cuando la consulta incluye datos externos maliciosos de gran tamaño y sin comprimir, es posible que un atacante que controle dichos datos introduzca de contrabando otro paquete de consulta en el flujo de conexión. |
11 Apr 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-444 |
11 Apr 2025, 15:39
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
11 Apr 2025, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-11 05:15
Updated : 2025-12-19 18:47
NVD link : CVE-2025-1386
Mitre link : CVE-2025-1386
CVE.ORG link : CVE-2025-1386
JSON object : View
Products Affected
clickhouse
- ch
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')