CVE-2026-46374: SQLFluff Parser Uncontrolled Resource Consumption Vulnerability
Summary
CVE-2026-46374: SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser. Affects sqlfluff versions < 4.2.0. Fixed in 4.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLFluff is an open-source SQL linter and formatter designed to help developers write clean and consistent SQL code. It provides features such as linting, formatting, and SQL dialect support. However, it is vulnerable to a Denial of Service (DoS) attack when untrusted users can submit SQL queries for parsing, potentially leading to resource exhaustion.
Vulnerability Detail
The vulnerability arises from the SQLFluff parser's inability to limit the resources consumed when processing SQL queries. An untrusted user can exploit this by submitting a maliciously long SQL query, which can lead to a Denial of Service (DoS) condition, causing the application to become unresponsive. This issue is classified under CWE-400, indicating uncontrolled resource consumption.
How To Fix
Latest published version: 4.4.0 as of 23 Oct 2026
pip install --upgrade "sqlfluff==4.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.0
This is the first release that contains the fix.
pip install --upgrade "sqlfluff==4.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a custom query length limit in your application logic to prevent excessively long queries from being processed by the SQLFluff parser.
Conclusion
CVE-2026-46374 presents a significant risk to applications using SQLFluff, particularly in environments where untrusted users can submit SQL queries. It is crucial to update to version 4.2.0 or higher to mitigate this risk effectively.
See every vulnerability recorded for sqlfluff →
FAQ
CVE-2026-46374 is a vulnerability in the SQLFluff parser that allows untrusted users to trigger a Denial of Service through resource exhaustion by submitting long SQL queries.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring installation.
The vulnerability has a CVSS score of 7.5, indicating a high severity level that requires prompt attention.
As a temporary measure, implement a custom query length limit in your application to prevent excessively long queries from being processed.
The vulnerability was discovered by Ori Nakar from the Imperva Threat Research Team.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlfluff.
