github.com/Clickhouse/Clickhouse-go/v2 is vulnerable to Race Condition
18
Low Risk
Affected versions are affected by a race condition due to concurrent map writes when using clickhouse.WithSettings(), leading to unexpected behavior and potential panics. Specifically, per-query settings persist across queries, and an empty clickhouse.WithSettings(nil) can cause a nil write panic. This occurs because settings were shared between contexts, leading to unintended overrides, such as max_execution_time and async_insert. The fix ensures that the settings map is always copied when read, preventing concurrency issues while maintaining performance. Additional tests and documentation updates have been included to clarify behavior and improve maintainability.
You are affected if you are using a version that falls within the vulnerable range.
github.com/Clickhouse/Clickhouse-go/v2 is vulnerable to Race Condition in versions 2.0.0 - 2.33.0.
Upgrade the github.com/Clickhouse/Clickhouse-go/v2 library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

SOC 2Compliant
ISO 27001Compliant