In short
- CVE-2026-46374 is a HIGH (CVSS 7.5) vulnerability affecting sqlfluff, sqlfluff (sqlfluff).
- Chance of exploitation in the next 30 days (EPSS): 0.26%, higher than 18.2% of all vulnerabilities.
- Fix: update to 4.2.0 or later.
| Package | Affected versions | Patched versions |
|---|
| sqlfluff PyPI | < 4.2.0
| 4.2.0
|
| sqlfluff | < 4.2.0
| 4.2.0
|
Description
Impact
In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion.
Patches
Versions 4.2.0 and up contain a configurable parse node limit, which is enabled by default, to prevent this manner of exploit.
Credit
Ori Nakar from Imperva Threat Research Team.
NVD description
SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.2.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free