25.3.8.30002 Altinity FIPS

25.3.8.30002 Altinity FIPS as compared to v25.3.8.30001.altinityfips

Critical Bug Fixes

• Bump brotli from v1.0.9 to v1.0.10; fix CVE-2026-111497 (#2752 by @mkmkme)
• Hardening: certificate chains containing the compromised eMudhra intermediate CAs or the roots that issued them (emSign Root TLS CA - G3, emSign ECC Root CA - G3) are rejected even if the trust store of the operating system still trusts them. The CA certificates embedded into the binary (used only when the system has none) are updated from the Chromium root store. There is no security issue in typical use cases. (ClickHouse#127318 by @alexey-milovidov via #2751)
• Fixed CVE-2026-116366

Packages

Available for both AMD64 and Aarch64 from https://builds.altinity.cloud/#altinityfips as either .deb, .rpm, or .tgz

These binaries include additional changes whose source is temporarily withheld pending coordinated security disclosure. The public tag identifies the public source baseline and does not contain all changes used to build these binaries.

Docker images

Available for both AMD64 and Aarch64: altinity/clickhouse-server:25.3.8.30002.altinityfips