CVE-2025-1386: Clickhouse Ch

Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days.

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.

Affected products

• Clickhouse Ch: before 0.65.0 (fixed in 0.65.0)

Published 2025-04-11. Last modified 2026-06-17.