Executive brief
SQLFluff is a tool used to check and format SQL code for developers. A vulnerability in its parsing engine allows an attacker to submit a specially crafted, long SQL query that consumes excessive system resources. This can lead to a denial-of-service (DoS) condition, crashing the application or making the service unavailable to legitimate users.
Technical details
A Denial of Service (DoS) vulnerability exists in the SQLFluff parser due to uncontrolled resource consumption (CWE-400). The root cause is the lack of limits on the complexity or length of parse nodes during the linting process. An unauthenticated remote attacker can exploit this by submitting a maliciously crafted, long SQL query to any application utilizing the SQLFluff library. This results in resource exhaustion, effectively crashing the service. The issue is addressed in version 4.2.0 by the introduction of a configurable parse node limit that is enabled by default.
Affected products
- sqlfluff sqlfluff < 4.2.0
Timeline
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-06-09: disclosed: CVE published to NVD
- 2026-04-20: patched: Fixed in version 4.2.0