| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/ClickHouse/ch-go | < 0.65.0 | 0.65.0 |
| ch | < 0.65.0 | 0.65.0 |
When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.
If you are using ch-go library, we recommend you to update to at least version 0.65.0.
This issue was found by lixts and reported through our bugcrowd program.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free