pip/sqlfluff: SQLFluff: Recursive Stack Overflow in Parser
摘要
Severity: HIGH | CVSS: 7.5 | CVE: CVE-2026-46373 | Package: pip/sqlfluff | Affected: < 4.1.0 | Patched: 4.1.0
正文
### Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion. ### Patches Versions 4.1.0 and up contain a configurable recursion limit, which is enabled by default, to prevent this manner of exploit. ### Credit Ori Nakar from Imperva Threat Research Team.
标签
- ecosystem:pip
- severity:high
- type:reviewed
扩展字段
{
"cve_id": "CVE-2026-46373",
"cvss_score": 7.5,
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"cwe_ids": [
"CWE-674"
],
"cwe_names": [
"Uncontrolled Recursion"
],
"ghsa_id": "GHSA-wmhf-fqc8-vxhh",
"package": {
"ecosystem": "pip",
"name": "sqlfluff",
"patched_version": "4.1.0",
"vulnerable_range": "< 4.1.0"
},
"references": [
"https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-wmhf-fqc8-vxhh",
"https://github.com/advisories/GHSA-wmhf-fqc8-vxhh"
],
"source_code_location": "https://github.com/sqlfluff/sqlfluff",
"updated_at": "2026-05-19T20:10:19Z"
}