CVE-2025-1386

Medium

Advisory

Published 12 Apr 2025In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.004; 32nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 25; of 17,781 indexed, latest versions
Container images: 24; deployed by those charts
Fix available: 1 of 1; affected package

CVE-2025-1386- Query smuggling in ch-go library

Carried by container images the latest versions of 25 of 17,781 indexed charts deploy, on 24 images.

Affected package	Affected versions	Fixed in	Images
github.com/ClickHouse/ch-gogolang	v0.47.3, v0.52.1, v0.58.2, v0.61.5+1 more	0.65.0	24

OSV records: GHSA-m454-3xv7-qj85
Also known as: GO-2025-3603

Charts affected

25 by stars

Chart

Latest

Affected images

Radar Score

ilumilum

6.7.3

1 of 19 See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
gitea/gitea :1.22.3	76f516a1a8c2	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

23,228

cosmocosmo-platform

0.20.0

3 of 10 See more

cosmo cosmo-platform 0.20.0

3 of the 10 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/controlplane :0.133.1	49800ff775f3	github.com/ClickHouse/ch-go@v0.58.2	0.65.0
ghcr.io/wundergraph/cosmo/graphqlmetrics :0.33.0	efb69ec3330c	github.com/ClickHouse/ch-go@v0.61.5	0.65.0
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

28,839

bentoself-hosters-by-night

0.9.1

1 of 1 See more

bento self-hosters-by-night 0.9.1

1 of the 1 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
ghcr.io/warpstreamlabs/bento :1.8.1	21715979aefa	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

1,046

elchi-stackelchi

1.13.0

1 of 10 See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.89.0	995f17004231	github.com/ClickHouse/ch-go@v0.58.2	0.65.0

Open the chart page →

15,383

beaconchain-explorerethereum-helm-charts

0.1.6

1 of 2 See more

beaconchain-explorer ethereum-helm-charts 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
gobitfly/eth2-beaconchain-explorer :latest	1d08a7986348	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

3,048

linkerd-jaegerlinkerd2-edge

30.14.11-edge

1 of 4 See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

1 of the 4 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.83.0	71fcef33ae71	github.com/ClickHouse/ch-go@v0.52.1	0.65.0

Open the chart page →

4,389

sp-otel-collectorsp-otel-collector

1.1.6

1 of 1 See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
quay.io/geored/spmm-collector-contrib :1.0.0	63baf86a49ac	github.com/ClickHouse/ch-go@v0.52.1	0.65.0

Open the chart page →

2,022

glassflow-etlglassflow

0.5.21

1 of 16 See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.108.0	923eb1cfae32	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

12,056

opentelemetry-demogpg-dev

0.33.8

1 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.114.0	37fa87091cfa	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

49,025

ilum-otel-collectorilum

0.1.0

1 of 1 See more

ilum-otel-collector ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.113.0	5ac3e0ba2b0b	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

1,384

sql-exporterjdstone

0.2.1

1 of 1 See more

sql-exporter jdstone 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
burningalchemist/sql_exporter :0.16.0	b8e4757c7def	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

885

kiaekiae

0.1.6

1 of 9 See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.63.1	dfb3a55ea8c9	github.com/ClickHouse/ch-go@v0.47.3	0.65.0

Open the chart page →

19,168

deepflowkubesphere-stable

6.2.606

1 of 8 See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
deepflowce/deepflowio-init-grafana :v6.2.6.5	6b51a0206b04	github.com/ClickHouse/ch-go@v0.47.3	0.65.0

Open the chart page →

18,316

nightingalelogic3579

0.3.1

1 of 6 See more

nightingale logic3579 0.3.1

1 of the 6 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
flashcatcloud/nightingale :8.5.1	421acb36181b	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

8,938

vikunjamt190502

7.1.2

1 of 3 See more

vikunja mt190502 7.1.2

1 of the 3 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
vikunja/vikunja :0.24.6	ed1f3ed467fe	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

2,968

cognativemya

0.2403.3

1 of 3 See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.96.0	7ef2a2ff46b9	github.com/ClickHouse/ch-go@v0.58.2	0.65.0

Open the chart page →

7,309

giteamya

23.12.5

1 of 1 See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
gitea/gitea :1.21.6	ac73e0da341f	github.com/ClickHouse/ch-go@v0.58.2	0.65.0

Open the chart page →

3,430

exporteropenshift

1.0.47

1 of 3 See more

exporter openshift 1.0.47

1 of the 3 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
public.ecr.aws/perfectscale-io/psc-exporter :v1.0.45-redhat	9083e60c38bc	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

13,000

vikunjapascaliske

5.1.0

1 of 1 See more

vikunja pascaliske 5.1.0

1 of the 1 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
vikunja/vikunja :0.24.6	ed1f3ed467fe	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

1,342

kubecostradar-base

1.0.0

1 of 7 See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
gcr.io/kubecost1/cost-model :prod-2.6.3	9e507ac0aebb	github.com/ClickHouse/ch-go@v0.62.0	0.65.0

Open the chart page →

9,355

opentelemetry-collectorsb-helm-charts

0.3.0

1 of 1 See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.96.0	7ef2a2ff46b9	github.com/ClickHouse/ch-go@v0.58.2	0.65.0

Open the chart page →

1,721

vikunjaschmitzis

1.0.0

1 of 3 See more

vikunja schmitzis 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
vikunja/vikunja :0.24.6	ed1f3ed467fe	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

4,070

cost-analyzersoftonic

2.5.5

1 of 6 See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
gcr.io/kubecost1/cost-model :prod-2.5.5	02b90651367f	github.com/ClickHouse/ch-go@v0.62.0	0.65.0

Open the chart page →

7,901

explorersynapse

0.2.16

1 of 6 See more

explorer synapse 0.2.16

1 of the 6 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
ghcr.io/synapsecns/sanguine/explorer :latest	00131e3d1eaf	github.com/ClickHouse/ch-go@v0.61.5	0.65.0

Open the chart page →

8,518

opentelemetry-collectorwikimedia

0.62.7

1 of 1 See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2025-1386.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	github.com/ClickHouse/ch-go@v0.52.1	0.65.0

Open the chart page →

2,022

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
vikunja/vikunja :0.24.6	ed1f3ed467fe	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	3
otel/opentelemetry-collector-contrib :0.96.0	7ef2a2ff46b9	github.com/ClickHouse/ch-go@v0.58.2	0.65.0	2
burningalchemist/sql_exporter :0.16.0	b8e4757c7def	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
deepflowce/deepflowio-init-grafana :v6.2.6.5	6b51a0206b04	github.com/ClickHouse/ch-go@v0.47.3	0.65.0	1
flashcatcloud/nightingale :8.5.1	421acb36181b	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
gitea/gitea :1.22.3	76f516a1a8c2	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
gitea/gitea :1.21.6	ac73e0da341f	github.com/ClickHouse/ch-go@v0.58.2	0.65.0	1
gobitfly/eth2-beaconchain-explorer :latest	1d08a7986348	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
otel/opentelemetry-collector-contrib :0.114.0	37fa87091cfa	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
otel/opentelemetry-collector-contrib :0.113.0	5ac3e0ba2b0b	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
otel/opentelemetry-collector-contrib :0.83.0	71fcef33ae71	github.com/ClickHouse/ch-go@v0.52.1	0.65.0	1
otel/opentelemetry-collector-contrib :0.108.0	923eb1cfae32	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
otel/opentelemetry-collector-contrib :0.89.0	995f17004231	github.com/ClickHouse/ch-go@v0.58.2	0.65.0	1
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	github.com/ClickHouse/ch-go@v0.52.1	0.65.0	1
otel/opentelemetry-collector-contrib :0.63.1	dfb3a55ea8c9	github.com/ClickHouse/ch-go@v0.47.3	0.65.0	1
gcr.io/kubecost1/cost-model :prod-2.5.5	02b90651367f	github.com/ClickHouse/ch-go@v0.62.0	0.65.0	1
gcr.io/kubecost1/cost-model :prod-2.6.3	9e507ac0aebb	github.com/ClickHouse/ch-go@v0.62.0	0.65.0	1
ghcr.io/synapsecns/sanguine/explorer :latest	00131e3d1eaf	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
ghcr.io/warpstreamlabs/bento :1.8.1	21715979aefa	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
ghcr.io/wundergraph/cosmo/controlplane :0.133.1	49800ff775f3	github.com/ClickHouse/ch-go@v0.58.2	0.65.0	1
ghcr.io/wundergraph/cosmo/graphqlmetrics :0.33.0	efb69ec3330c	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
public.ecr.aws/perfectscale-io/psc-exporter :v1.0.45-redhat	9083e60c38bc	github.com/ClickHouse/ch-go@v0.61.5	0.65.0	1
quay.io/geored/spmm-collector-contrib :1.0.0	63baf86a49ac	github.com/ClickHouse/ch-go@v0.52.1	0.65.0	1