Kurz gesagt
- CVE-2026-46374 ist eine Schwachstelle (HOCH (CVSS 7.5)) in sqlfluff, sqlfluff (sqlfluff).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.26%, höher als bei 18.2% aller Schwachstellen.
- Abhilfe: auf 4.2.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| sqlfluff PyPI | < 4.2.0
| 4.2.0
|
| sqlfluff | < 4.2.0
| 4.2.0
|
Description
Impact
In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion.
Patches
Versions 4.2.0 and up contain a configurable parse node limit, which is enabled by default, to prevent this manner of exploit.
Credit
Ori Nakar from Imperva Threat Research Team.
NVD description
SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.2.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free