CVE-2025-1386: ClickHouse Ch-Go Library SSRF Vulnerability

CVE-2025-1386 Overview

CVE-2025-1386 is an HTTP Request Smuggling vulnerability affecting the ClickHouse ch-go library, a Go client for ClickHouse databases. When using this library under specific conditions involving queries with large, uncompressed malicious external data, an attacker who controls such data can smuggle additional query packets into the connection stream. This vulnerability falls under CWE-444 (Inconsistent Interpretation of HTTP Requests), which relates to HTTP Request Smuggling attacks.

Critical Impact
Attackers with high privileges who control external data inputs can inject unauthorized queries into the database connection stream, potentially leading to unauthorized data access or manipulation of ClickHouse database operations.

Affected Products

ClickHouse ch-go library for Go
Applications using the ch-go library with external data functionality
ClickHouse database deployments utilizing the vulnerable ch-go client versions

Discovery Timeline

April 11, 2025 - CVE-2025-1386 published to NVD
December 19, 2025 - Last updated in NVD database

Technical Details for CVE-2025-1386

Vulnerability Analysis

This vulnerability exists in the ch-go library's handling of external data within query requests. The issue stems from improper parsing and boundary handling when processing large, uncompressed external data payloads. Under specific conditions, the library fails to properly delineate query boundaries, allowing an attacker to inject additional query packets into the established connection stream.

HTTP Request Smuggling vulnerabilities like this one occur when there is inconsistent interpretation of HTTP request boundaries between different components in the request processing pipeline. In this case, the ch-go library's connection handling mechanism can be exploited when malicious external data is crafted to contain embedded query structures that bypass normal query parsing.

The attack requires network access and high privileges, but does not require user interaction. Successful exploitation could result in high confidentiality impact, allowing attackers to access sensitive data by executing unauthorized queries against the ClickHouse database.

Root Cause

The root cause is improper handling of request boundaries in the ch-go library when processing external data within queries. The library does not adequately validate or sanitize large uncompressed external data inputs, creating a condition where query packet boundaries become ambiguous. This allows malicious payloads to be interpreted as separate query packets rather than data content.

Attack Vector

The attack vector is network-based and requires an attacker with high privileges who can control external data inputs to queries executed through the ch-go library. The attacker must craft malicious external data that, when included in a query, causes the library to misinterpret packet boundaries. This results in the smuggled query being executed as a separate, legitimate query on the ClickHouse database connection.

The exploitation process involves:

Identifying an application using the vulnerable ch-go library that accepts external data inputs
Crafting a large, uncompressed external data payload containing embedded query structures
Submitting the malicious payload through normal query channels
The library misparses the boundaries, executing the smuggled query

For detailed technical information about this vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-1386

Indicators of Compromise

Unusual or unexpected queries appearing in ClickHouse query logs
Large external data payloads in query requests that exceed normal operational patterns
Database operations occurring that do not correspond to legitimate application activity
Anomalous connection behavior or multiple queries executed within single connection sessions

Detection Strategies

Monitor ClickHouse query logs for unauthorized or unexpected query patterns
Implement application-level logging to track external data sizes and sources
Deploy network monitoring to detect abnormally large query payloads to ClickHouse instances
Review database audit logs for queries executed with unexpected timing or content

Monitoring Recommendations

Enable comprehensive query logging on ClickHouse servers
Implement alerting for queries exceeding normal size thresholds for external data
Monitor ch-go library versions in use across applications and flag vulnerable deployments
Establish baseline query patterns and alert on deviations that may indicate smuggling attempts

How to Mitigate CVE-2025-1386

Immediate Actions Required

Audit all applications using the ch-go library to identify vulnerable deployments
Restrict external data functionality to trusted sources only until patches are applied
Implement input validation and size limits on external data inputs at the application layer
Review ClickHouse access controls to ensure principle of least privilege

Patch Information

Refer to the GitHub Security Advisory for the latest patched version of the ch-go library. Upgrading to the patched version is the recommended remediation. Organizations should update their Go module dependencies to incorporate the fixed ch-go library version.

Workarounds

Disable or restrict external data functionality in queries where possible
Implement strict input validation on all external data before passing to ch-go
Apply network-level controls to limit access to ClickHouse instances from untrusted sources
Consider implementing query allowlists or query analysis middleware to detect anomalous patterns

bash

# Configuration example - Update go.mod to latest ch-go version
go get github.com/ClickHouse/ch-go@latest
go mod tidy