SQLFluff CVE-2026-46374
HIGH
GHSA-73jc-5mrq-prw7
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Blast Radius
ecosystem impact- 1 pypi packages depend on sqlfluff (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.2.0.
DescriptionNVD
Impact
In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion.
Patches
Versions 4.2.0 and up contain a configurable parse node limit, which is enabled by default, to prevent this manner of exploit.
Credit
Ori Nakar from Imperva Threat Research Team.
AnalysisAI
Denial of service in SQLFluff parser (pip/sqlfluff) versions prior to 4.2.0 allows remote unauthenticated attackers to exhaust CPU and memory resources by submitting an excessively long or malicious SQL query for linting. The flaw affects any application that exposes the SQLFluff parser to untrusted input. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all SQLFluff deployments and determine which systems process external or untrusted SQL input. Within 7 days: Implement compensating controls for high-risk instances and restrict parser access to authenticated, internal users only. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today