2026 Changelog

ClickHouse release v25.3.13.19-lts (d6202689cb5) FIXME as compared to v25.3.12.8-lts (58271a59e2d)

Bug Fix (user-visible misbehavior in an official stable release)

• Backported in #92030: Fix GenerateRandom engine crash on non-literal parameters: return BAD_ARGUMENTS with a clear message instead of LOGICAL_ERROR. #88157 (Shafi Ahmed).
• Backported in #90415: Fixed a crash during the clean server shutdown due to wrong destruction order. Resolves #82420. #90076 (Nikita Mikhaylov).
• Backported in #94008: Fixed crash on integer overflow in randomStringUTF8. #90326 (Michael Kolupaev).
• Backported in #93555: Fix crash when deserialising malformed groupConcat aggregate state with out-of-bounds offsets. #93028 (Raufs Dunamalijevs).
• Backported in #93468: Fixed integer overflow vulnerability in groupConcat state deserialisation that could cause memory safety issues with crafted aggregate states. #93426 (Raufs Dunamalijevs).
• Backported in #93684: Make sure that zookeeper is finalized on shutdown (fix possible hung on shutdown in very unlikely cases). #93602 (Azat Khuzhin).
• Backported in #93950: Fix LOGICAL_ERROR when restoring ReplicatedMergeTree with deduplication race. #93612 (Pablo Marcos).
• Backported in #93961: Fix using Sparse column for TTL update during direct deserialization into Sparse columns in some input formats. It fixes possible logical error Unexpected type of result TTL column. #93619 (Pavel Kruglov).
• Backported in #93804: Validate that the decompressed buffer size is as expected. #93690 (Raúl Marín).
• Backported in #93794: Prevent users to get the list of columns from a table without checking SHOW COLUMNS permission using the merge table engine. #93695 (János Benjamin Antal).
• Backported in #94159: Fixes https://github.com/ClickHouse/clickhouse-core-incidents/issues/1217. Exception was thrown from a socket.setBlocking(true) call inside SCOPE_EXIT: logs. Because SCOPE_EXIT creates a scope guard object and runs the provided code in the scope guard's destructor, we can't use SCOPE_EXIT with functions that throw exceptions and should use SCOPE_EXIT_SAFE instead. #94100 (Miсhael Stetsyuk).
• Backported in #94633: Related issue: #80315 CIDB: link. #94123 (Tuan Pham Anh).
• Backported in #94253: Fix nullptr dereference in PostgreSQL database engines (when the query is incorrect). Closes #92887. #94180 (Alexey Milovidov).
• Backported in #94345: Fix obscure bug in ZooKeeper client on connect which leads to hungs and crashes. #94320 (Azat Khuzhin).
• Backported in #94405: Fix incorrect value of current metric FilesystemCacheSizeLimit in case SLRU cache policy was used. #94363 (Kseniia Sumarokova).

Build/Testing/Packaging Improvement

• Backported in #94221: Bump c-ares from v1.34.5 to v1.34.6. This addresses c-ares' CVE-2025-62408, which is not relevant for ClickHouse. #94129 (Govind R Nair).

NOT FOR CHANGELOG / INSIGNIFICANT

• Backported in #93697: Add additional validations in JSON column. #93453 (Pavel Kruglov).
• Backported in #93985: Fix exception message. #93915 (Kseniia Sumarokova).