CVE-2026-46374
Received Received - Intake
Denial of Service in SQLFluff via Malicious Query

Publication date: 2026-06-09

Last updated on: 2026-06-09

Assigner: GitHub, Inc.

Description
SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.2.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-09
Last Modified
2026-06-09
Generated
2026-06-10
AI Q&A
2026-06-10
EPSS Evaluated
N/A
NVD
CVE-2026-46374
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sqlfluff sqlfluff to 4.2.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability in SQLFluff allows an untrusted user to trigger a Denial of Service (DoS) through resource exhaustion by submitting a maliciously long SQL query. This DoS impacts availability but does not affect confidentiality or integrity of data.

Since the vulnerability does not lead to unauthorized access or data leakage, it primarily affects the availability aspect of systems using SQLFluff. Compliance standards like GDPR and HIPAA require ensuring availability of systems and services, so this vulnerability could negatively impact compliance by causing service disruptions.

However, there is no direct indication from the provided information that this vulnerability leads to violations of data privacy or protection requirements under these regulations.

Executive Summary

This vulnerability affects SQLFluff, a SQL linter and auto-formatter. Before version 4.2.0, if an application using SQLFluff allows untrusted users to submit SQL queries for linting, a malicious user can send a very long, crafted SQL query. This can cause the parser to consume excessive resources, leading to a Denial of Service (DoS) condition through resource exhaustion.

Impact Analysis

The primary impact of this vulnerability is a Denial of Service (DoS). An attacker can cause the application using SQLFluff to become unresponsive or crash by submitting maliciously long SQL queries. This can disrupt normal operations and availability of the affected service.

Mitigation Strategies

To mitigate this vulnerability, upgrade SQLFluff to version 4.2.0 or later, where the issue has been patched.

Additionally, avoid allowing untrusted users to submit SQL queries to be linted by the parser, as this can be exploited to trigger a Denial of Service through resource exhaustion.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart