| Package | Affected versions | Patched versions |
|---|---|---|
| sqlfluff | < 4.1.0 | 4.1.0 |
| sqlfluff | < 4.1.0 | 4.1.0 |
In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion.
Versions 4.1.0 and up contain a configurable recursion limit, which is enabled by default, to prevent this manner of exploit.
Ori Nakar from Imperva Threat Research Team.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free