CVE-2026-46374

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.2.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-73jc-5mrq-prw7	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sqlfluff:sqlfluff:*:*:*:*:*:*:*:*

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) SQLFluff es un linter y autoformateador de SQL modular con soporte para múltiples dialectos y código con plantillas. Antes de la versión 4.2.0, en implementaciones donde usuarios no confiables pueden proporcionar consultas SQL para ser analizadas, un usuario no confiable puede enviar una consulta larga maliciosa a cualquier aplicación que utilice el analizador para desencadenar una denegación de servicio mediante el agotamiento de recursos. Este problema ha sido parcheado en la versión 4.2.0.

12 Jun 2026, 14:01

Type	Values Removed	Values Added
CPE		cpe:2.3:a:sqlfluff:sqlfluff::::::::
First Time		Sqlfluff Sqlfluff sqlfluff
References	~~() https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-73jc-5mrq-prw7 -~~	() https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-73jc-5mrq-prw7 - Vendor Advisory

09 Jun 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 23:16

Updated : 2026-07-23 09:10

NVD link : CVE-2026-46374

Mitre link : CVE-2026-46374

CVE.ORG link : CVE-2026-46374

JSON object : View

Products Affected

sqlfluff

sqlfluff

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-46374", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46374", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-10T12:57:27.239348Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sqlfluff", "product": "sqlfluff", "versions": [{"status": "affected", "version": "< 4.2.0"}]}]}], "published": "2026-06-09T23:16:59.313", "references": [{"url": "https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-73jc-5mrq-prw7", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.2.0."}, {"lang": "es", "value": "SQLFluff es un linter y autoformateador de SQL modular con soporte para m\u00faltiples dialectos y c\u00f3digo con plantillas. Antes de la versi\u00f3n 4.2.0, en implementaciones donde usuarios no confiables pueden proporcionar consultas SQL para ser analizadas, un usuario no confiable puede enviar una consulta larga maliciosa a cualquier aplicaci\u00f3n que utilice el analizador para desencadenar una denegaci\u00f3n de servicio mediante el agotamiento de recursos. Este problema ha sido parcheado en la versi\u00f3n 4.2.0."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sqlfluff:sqlfluff:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C9B826E-205A-4C1D-BDD6-187BC334E929", "versionEndExcluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}