Quick answers
- Is CVE-2026-46373 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-46373 being exploited in the wild.
- How severe is CVE-2026-46373?
- High severity, with a CVSS score of 7.5, published 9 June 2026.
- Which products and versions are affected?
- sqlfluff (PyPI) < 4.1.0, ECOSYSTEM:introduced=0,fixed=4.1.0.
- Is there a fix for CVE-2026-46373?
- Yes. sqlfluff (PyPI): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-46373 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-46373?
- Check whether you run sqlfluff (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- sqlfluff (PyPI): upgrade to 4.1.0 or later
pip install "sqlfluff>=4.1.0"
Technical details
SQLFluff prior to version 4.1.0 is vulnerable to Uncontrolled Recursion (CWE-674) within its parser component. When processing SQL queries with deliberate, excessive nesting, the parser fails to limit recursion depth, leading to a stack overflow or general resource exhaustion. This can be exploited remotely without authentication if the library is integrated into a service that accepts untrusted SQL input. The vulnerability results in a Denial of Service (DoS) of the parsing process. The issue is resolved in version 4.1.0, which introduces a configurable recursion limit that is enabled by default.
Affected products
- SQLFluff SQLFluff < 4.1.0
Identifiers
- CVE-2026-46373
- GHSA-wmhf-fqc8-vxhh
- PYSEC-2026-209
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: NVD publication date
- 2026-06-09: patched: Version 4.1.0 released with recursion limits