CVE-2026-46373

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.1.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-wmhf-fqc8-vxhh	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlfluff:sqlfluff:*:*:*:*:*:*:*:*

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) SQLFluff es un linter y autoformateador de SQL modular con soporte para múltiples dialectos y código con plantillas. Antes de la versión 4.1.0, en implementaciones donde usuarios no confiables pueden proporcionar consultas SQL para ser analizadas, un usuario no confiable puede enviar una consulta maliciosa con anidamiento excesivo deliberado a cualquier aplicación que utilice el analizador para desencadenar una denegación de servicio a través del agotamiento de recursos. Este problema ha sido parcheado en la versión 4.1.0.

12 Jun 2026, 14:10

Type	Values Removed	Values Added
First Time		Sqlfluff Sqlfluff sqlfluff
References	~~() https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-wmhf-fqc8-vxhh -~~	() https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-wmhf-fqc8-vxhh - Vendor Advisory
CPE		cpe:2.3:a:sqlfluff:sqlfluff::::::::

09 Jun 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 23:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-46373

Mitre link : CVE-2026-46373

CVE.ORG link : CVE-2026-46373

JSON object : View

Products Affected

sqlfluff

sqlfluff

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-46373", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46373", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T14:28:11.018154Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sqlfluff", "product": "sqlfluff", "versions": [{"status": "affected", "version": "< 4.1.0"}]}]}], "published": "2026-06-09T23:16:59.167", "references": [{"url": "https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-wmhf-fqc8-vxhh", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.1.0."}, {"lang": "es", "value": "SQLFluff es un linter y autoformateador de SQL modular con soporte para m\u00faltiples dialectos y c\u00f3digo con plantillas. Antes de la versi\u00f3n 4.1.0, en implementaciones donde usuarios no confiables pueden proporcionar consultas SQL para ser analizadas, un usuario no confiable puede enviar una consulta maliciosa con anidamiento excesivo deliberado a cualquier aplicaci\u00f3n que utilice el analizador para desencadenar una denegaci\u00f3n de servicio a trav\u00e9s del agotamiento de recursos. Este problema ha sido parcheado en la versi\u00f3n 4.1.0."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sqlfluff:sqlfluff:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80AEEC21-C29E-4A72-BDB6-48584BCFBC6C", "versionEndExcluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}