CVE-2026-3293: Snowflake JDBC Driver Vulnerable to Uncontrolled Resource Consumption
Summary
CVE-2026-3293: Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner. Affects net.snowflake:snowflake-jdbc versions < 4.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Snowflake JDBC Driver is a Java-based library that enables applications to connect to Snowflake's cloud data platform. It provides a robust interface for executing SQL queries and managing database connections. The driver is widely used in various applications for data analytics and reporting. However, versions up to 4.0.1 are susceptible to a vulnerability that can lead to uncontrolled resource consumption, particularly through the SdkProxyRoutePlanner component.
Vulnerability Detail
The vulnerability arises from a weakness in the SdkProxyRoutePlanner function within the Snowflake JDBC Driver. Specifically, the manipulation of the 'nonProxyHosts' argument can lead to inefficient regular expression complexity, which may result in excessive resource consumption. This issue can only be exploited locally, but the potential for denial of service or application slowdown makes it a significant concern. The vulnerability has been publicly disclosed, and an exploit is available.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of the 'nonProxyHosts' argument in your configurations until the driver is updated. This may help mitigate the risk of resource consumption until a patch can be applied.
Conclusion
The Snowflake JDBC Driver has a vulnerability that can lead to uncontrolled resource consumption, particularly affecting versions up to 4.0.1. It is crucial to update to version 4.0.2 or later to mitigate this risk. Users can also utilize Vulert to monitor and check for vulnerabilities in their applications.
See every vulnerability recorded for net.snowflake:snowflake-jdbc →
FAQ
The vulnerability allows for uncontrolled resource consumption due to inefficient regular expression handling in the SdkProxyRoutePlanner function.
Versions up to 4.0.1 of the Snowflake JDBC Driver are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
Yes, a patch is available in version 4.0.2 of the Snowflake JDBC Driver. It is recommended to update to this version.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.snowflake:snowflake-jdbc.
