CVE-2026-46373: SQLFluff: Recursive Stack Overflow in Parser

Synopsis

A recursive stack overflow vulnerability in SQLFluff's SQL parser allows an unauthenticated remote attacker to crash any application that passes untrusted SQL input to SQLFluff for linting or formatting. The attacker submits a specially crafted query with deliberately excessive nesting, causing the parser to exhaust stack resources. Successful exploitation results in a denial of service, taking the affected application or service offline. No fix version has been published upstream yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable service over the network; any internet- or intranet-exposed application that accepts SQL input for linting is in scope.

• AuthenticationNot required

  No credentials are needed; the attacker only needs the ability to submit a SQL query to the exposed endpoint.

• Victim interactionNot required

  The attack is fully automated and requires no action from a user or administrator to trigger the crash.

• Attack complexityDetail

  Exploitation is reliable and condition-free; crafting a deeply nested SQL query requires no special timing, memory layout knowledge, or environmental prerequisites.

Blast Radius

• Crashes the process or service running SQLFluff, making linting and formatting unavailable until the service is restarted.
• Sustained or repeated submissions can keep the service continuously unavailable, effectively acting as a persistent denial of service against any pipeline or application that depends on SQLFluff.
• No confidentiality or data-integrity impact is associated with this vulnerability; the attacker cannot read or modify data through this exploit.