In short
- CVE-2026-46373 is a HIGH (CVSS 7.5) vulnerability affecting sqlfluff, sqlfluff (sqlfluff).
- Chance of exploitation in the next 30 days (EPSS): 0.26%, higher than 18.2% of all vulnerabilities.
- Fix: update to 4.1.0 or later.
| Package | Affected versions | Patched versions |
|---|
| sqlfluff PyPI | < 4.1.0
| 4.1.0
|
| sqlfluff | < 4.1.0
| 4.1.0
|
Description
Impact
In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion.
Patches
Versions 4.1.0 and up contain a configurable recursion limit, which is enabled by default, to prevent this manner of exploit.
Credit
Ori Nakar from Imperva Threat Research Team.
NVD description
SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.1.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free