CVE-2026-46373
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
SQLFluff prior to version 4.1.0 is vulnerable to a DoS attack via resource exhaustion. An untrusted user can submit a malicious SQL query with excessive nesting, causing parser overload.
Risk Assessment
The organization is at risk of service disruption for applications using SQLFluff for SQL linting, potentially leading to service unavailability.
Recommendation
Update SQLFluff to version 4.1.0 or later.
Other vulnerabilities in SQLFluff
See all- CVE-2026-46374High
SQLFluff, a modular SQL linter and auto-formatter, prior to version 4.2.0 is vulnerable to a DoS attack via resource exhaustion. An untrusted user can submit a malicious long SQL query, causing parser overload.
- CVE-2023-36830Medium
SQLFluff, a SQL linter, prior to version 2.1.2 had a vulnerability that allowed untrusted users to execute arbitrary Python code by modifying the `library_path` value in configuration files. Version 2.1.2 introduces the ability to overwrite this value from the command line, mitigating the risk.
Original NVD description (English source)
SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.1.0.