Executive brief
SQLFluff is a tool used by developers to automatically check and format SQL database code. A vulnerability in the way it processes complex code allows an attacker to submit a specially crafted, deeply nested SQL query that crashes the application. This results in a denial-of-service, potentially disrupting automated development pipelines or web services that integrate SQLFluff for user-provided queries.
Technical details
SQLFluff prior to version 4.1.0 is vulnerable to Uncontrolled Recursion (CWE-674) within its parser component. When processing SQL queries with deliberate, excessive nesting, the parser fails to limit recursion depth, leading to a stack overflow or general resource exhaustion. This can be exploited remotely without authentication if the library is integrated into a service that accepts untrusted SQL input. The vulnerability results in a Denial of Service (DoS) of the parsing process. The issue is resolved in version 4.1.0, which introduces a configurable recursion limit that is enabled by default.
Affected products
- SQLFluff SQLFluff < 4.1.0
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: NVD publication date
- 2026-06-09: patched: Version 4.1.0 released with recursion limits