En resumen
- CVE-2026-46374 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a sqlfluff, sqlfluff (sqlfluff).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.26%, mayor que el 18.2% de las vulnerabilidades.
- Solución: actualizar a 4.2.0 o posterior.
| Package | Affected versions | Patched versions |
|---|
| sqlfluff PyPI | < 4.2.0
| 4.2.0
|
| sqlfluff | < 4.2.0
| 4.2.0
|
Description
Impact
In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion.
Patches
Versions 4.2.0 and up contain a configurable parse node limit, which is enabled by default, to prevent this manner of exploit.
Credit
Ori Nakar from Imperva Threat Research Team.
NVD description
SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.2.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free