CVE-2026-46374: SQLFluff: Uncontrolled Resource Consumption in Parser

Synopsis

Uncontrolled resource consumption in SQLFluff's SQL parser allows an unauthenticated remote attacker to exhaust system resources by submitting a specially crafted long SQL query. The vulnerability is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable in any deployment that accepts SQL input from untrusted users. Successful exploitation crashes or severely degrades the linting service, resulting in a denial of service. A patched-image rebuild at version 4.2.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The parser must be reachable over the network; any deployment that accepts SQL queries from external or untrusted clients is directly exposed.

• AuthenticationNot required

  No credentials or session token are needed; the attacker submits a malicious query as an anonymous request.

• Victim interactionNot required

  The attack is fully automated and requires no action from an administrator or end user to trigger resource exhaustion.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to send a sufficiently long SQL query and no special timing or environmental setup is required.

Blast Radius

• Exhausts CPU or memory on the host running the SQLFluff parser, causing the linting or formatting service to become unresponsive or crash.
• Downstream CI pipelines or API endpoints that depend on SQLFluff for query validation are blocked, halting automated workflows until the process is restarted.
• Persistent or repeated submissions can keep the service unavailable, effectively turning a single malicious query into a sustained outage.