Vulnerability · Published Jun 9, 2026 · Assigned by GitHub_M
CVE-2026-46374SQLFluff: Uncontrolled Resource Consumption in Parser
High 7.5
In plain English
A high-severity uncontrolled resource consumption in sqlfluff from sqlfluff. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.2.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sqlfluff | no fix listed | DEBIAN-CVE-2026-46374 |
| Debian:13 | sqlfluff | no fix listed | DEBIAN-CVE-2026-46374 |
| Debian:14 | sqlfluff | 4.3.0-1 | DEBIAN-CVE-2026-46374 |
| PyPI | sqlfluff | 4.2.0 | GHSA-73jc-5mrq-prw7 |
| PyPI | sqlfluff | 4.2.0 | PYSEC-2026-210 |
| Ubuntu:24.04:LTS | sqlfluff | no fix listed | UBUNTU-CVE-2026-46374 |
| Ubuntu:25.10 | sqlfluff | no fix listed | UBUNTU-CVE-2026-46374 |
| Ubuntu:26.04:LTS | sqlfluff | no fix listed | UBUNTU-CVE-2026-46374 |
| Ubuntu:26.10 | sqlfluff | no fix listed | UBUNTU-CVE-2026-46374 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-73jc-5mrq-prw7 x_refsource_CONFIRM