Intel

AIKIDO-2025-10178

github.com/Clickhouse/Clickhouse-go/v2 is vulnerable to Race Condition

Race Condition Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Mar 25, 2025

18

Low Risk

This Affects:

GOgithub.com/Clickhouse/Clickhouse-go/v2
2.0.0 - 2.33.0
Fixed in 2.33.1
Are you affected? Scan for Free

TL;DR

Affected versions are affected by a race condition due to concurrent map writes when using clickhouse.WithSettings(), leading to unexpected behavior and potential panics. Specifically, per-query settings persist across queries, and an empty clickhouse.WithSettings(nil) can cause a nil write panic. This occurs because settings were shared between contexts, leading to unintended overrides, such as max_execution_time and async_insert. The fix ensures that the settings map is always copied when read, preventing concurrency issues while maintaining performance. Additional tests and documentation updates have been included to clarify behavior and improve maintainability.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

github.com/Clickhouse/Clickhouse-go/v2 is vulnerable to Race Condition in versions 2.0.0 - 2.33.0.

How to fix this

Upgrade the github.com/Clickhouse/Clickhouse-go/v2 library to the patch version.