Attack Chain

1. An attacker crafts an extremely long and complex SQL query designed to consume excessive resources during parsing.
2. The attacker submits the malicious SQL query to an application that uses a vulnerable version of SQLFluff (prior to 4.2.0) for linting purposes.
3. The application passes the query to the SQLFluff parser.
4. The SQLFluff parser attempts to process the extremely long and complex SQL query.
5. Due to the lack of input validation and resource limits in vulnerable versions, the parser consumes excessive CPU and memory.
6. The application’s performance degrades significantly as system resources are exhausted.
7. The application becomes unresponsive or crashes due to the resource exhaustion, leading to a denial-of-service.
8. Legitimate users are unable to access the application or its SQL linting functionality.

Impact

Successful exploitation of this vulnerability can result in a denial-of-service condition, rendering applications relying on SQLFluff unavailable. The impact is particularly significant in environments where untrusted users can submit arbitrary SQL queries for linting, as it allows malicious actors to easily disrupt service availability. There is no specific victim count available. This affects any environment using SQLFluff prior to version 4.2.0.

Recommendation

• Upgrade SQLFluff to version 4.2.0 or later to incorporate the fix for CVE-2026-46374.
• Implement input validation and sanitization on SQL queries submitted for linting to prevent excessively long or complex queries from reaching the SQLFluff parser.
• Monitor system resource utilization (CPU, memory) on systems running SQLFluff to detect potential resource exhaustion attacks. Consider deploying the Sigma rule Detect SQLFluff Excessive Query Length to identify potentially malicious queries based on their length.
• Configure the parse node limit in SQLFluff 4.2.0 and later to restrict the resources consumed by the parser when processing complex SQL queries.