Query smuggling in ch-go library

CVE-2025-1386 is a query smuggling vulnerability in the ch-go library, a low-level Go client for ClickHouse. Under specific conditions, when a query includes a large, uncompressed malicious external data block, an attacker can inject a second query packet into the same connection stream [2][3].

Exploitation requires the attacker to control external data supplied to a query, such as in an INSERT or SELECT with external data. The malicious data is crafted to be large and uncompressed, allowing the attacker to smuggle an additional query packet that the server processes as a separate query [3]. No authentication bypass is needed; the attacker simply controls the data sent with a legitimate query.

Successful exploitation allows the attacker to execute arbitrary SQL queries on the ClickHouse server, potentially leading to data exfiltration, modification, or denial of service. The attack is performed within the context of the existing connection, so the attacker gains the privileges of the user executing the original query.

The vulnerability has been patched in ch-go version 0.65.0 [4]. Users should upgrade immediately. There is no known workaround; using compressed external data or limiting external data size may reduce risk but not eliminate it [3].