Log in Start free

Vulnerability · Published Feb 27, 2026 · Assigned by VulDB

CVE-2026-3293snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos

Low 3.3

In plain English

A low-severity regular-expression denial of service in snowflake-jdbc from snowflakedb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.3%top 82.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts can lead to inefficient regular expression complexity. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 5fb0a8a318a2ed87f4022a1f56e742424ba94052. A patch should be applied to remediate this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavennet.snowflake:snowflake-jdbcno fix listedGHSA-gx6c-pv62-9mcf

Affected products (as reported)

VendorProductVersions
snowflakedb snowflake-jdbc 4.0.04.0.1

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References