5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-1386

CVE-2025-1386: CVE-2025-1386- Query smuggling in ch-go library

Impact

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.

Patches

If you are using ch-go library, we recommend you to update to at least version 0.65.0.

Credit

This issue was found by lixts and reported through our bugcrowd program.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-1386

CVE-2025-1386:

5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ClickHouse/ch-go	go	< 0.65.0	0.65.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the provided commit 0e835663df32b09b828528c07a5507686e6d975e. The commit message explicitly states 'fix(compressor): fixing an overflow that could potentially smuggle query in from data'. The diff shows changes in compress/writer.go, specifically within the Compress method of the Writer struct. The added lines introduce a check to prevent an integer overflow when calculating the size of the compressed data (n + compressHeaderSize). This overflow, if it occurred, would affect how the w.Data slice is sized, which is critical for correctly framing the compressed data. An incorrect frame size could allow an attacker to append malicious data that gets misinterpreted as part of a subsequent query, leading to query smuggling. Therefore, the (*Writer).Compress function is identified as the vulnerable function because it's where the overflow could occur and where the fix was applied.

Based on the commit information, the vulnerable function is (*Writer).Compress in compress/writer.go. The patch introduces a check to prevent an integer overflow when calculating the compressed data size. Without this check, a large input could cause n + headerSize to wrap around, leading to a smaller-than-expected buffer allocation for w.Data. This could allow an attacker to write data beyond the intended buffer, potentially smuggling additional query packets into the stream. The function processes input (data to be compressed) and is directly involved in the size calculation that was flawed.

Runtime Indicators: During exploitation, a profiler would likely show (*Writer).Compress as a function being executed. If logging or detailed stack traces are available, this function would appear when the oversized malicious data is processed.

Precise Function Signature: github.com/ClickHouse/ch-go/compress.(*Writer).Compress (assuming the package structure and how Go profilers typically represent method calls on struct pointers). The file path is compress/writer.go.

Confidence: High, as the patch directly addresses the overflow in this specific function, and the commit message confirms the vulnerability context (query smuggling due to overflow).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.