CVE-2026-46374

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.2.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-73jc-5mrq-prw7	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlfluff:sqlfluff:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-09 23:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-46374

Mitre link : CVE-2026-46374

CVE.ORG link : CVE-2026-46374

JSON object : View

Products Affected

sqlfluff

sqlfluff

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-46374", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46374", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T12:57:27.239348Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sqlfluff", "product": "sqlfluff", "versions": [{"status": "affected", "version": "< 4.2.0"}]}]}], "published": "2026-06-09T23:16:59.313", "references": [{"url": "https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-73jc-5mrq-prw7", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.2.0."}, {"lang": "es", "value": "SQLFluff es un linter y autoformateador de SQL modular con soporte para m\u00faltiples dialectos y c\u00f3digo con plantillas. Antes de la versi\u00f3n 4.2.0, en implementaciones donde usuarios no confiables pueden proporcionar consultas SQL para ser analizadas, un usuario no confiable puede enviar una consulta larga maliciosa a cualquier aplicaci\u00f3n que utilice el analizador para desencadenar una denegaci\u00f3n de servicio mediante el agotamiento de recursos. Este problema ha sido parcheado en la versi\u00f3n 4.2.0."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sqlfluff:sqlfluff:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C9B826E-205A-4C1D-BDD6-187BC334E929", "versionEndExcluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}