What is CVE-2025-1386?

CVE-2025-1386 is a medium-severity vulnerability in Ch-Go, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 4.9/10. Published 2025-04-11.

How severe is CVE-2025-1386?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Vulnerability in Ch-Go

CVE-2025-1386

When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.

Vulnerability class: HTTP Request Smuggling

EPSS: 0.004 (29.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Affected products

Ch-go — versions 0
Clickhouse Ch

Weakness classification (CWE)

CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling)

References

cb7ba516-3b07-4c98-b0c2-715220f1a8f6 (Vendor Advisory)

Frequently asked questions

What is CVE-2025-1386?: CVE-2025-1386 is a medium-severity vulnerability in Ch-Go, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 4.9/10. Published 2025-04-11.
How severe is CVE-2025-1386?: Medium severity. CVSS v3 base score is 4.9 out of 10.