The Hidden DoS Vector in SQL Parsers

SQL parsers are critical components of the modern data stack. They validate queries before they reach the database, transpile between dialects, and lint codebases for style violations. Increasingly, they also power AI-driven SQL generation in LLM-integrated data tools. Our research focused on two...

ROOT-APP-PYPI-CVE-2026-46374 CVE-2026-46374 in sqlfluff - Patched by Root

Root has patched CVE-2026-46374 in the sqlfluff package for Root:PyPI. Multiple fixed versions available...

CVE-2026-46374

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to...

CVE-2026-46373

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any...

Linux Distros Unpatched Vulnerability : CVE-2026-46373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untruste...

Linux Distros Unpatched Vulnerability : CVE-2026-46374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untruste...

DEBIAN-CVE-2026-46373

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any...

PYSEC-2026-209

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any...

PYSEC-2026-210

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.2.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious long query to any application using the parser to...

dbt-coves (>=0.19.1a7, <=0.21.0a1), jsqlib (>=0.3.0a0, <=0.8.0a0) potentially affected by CVE-2026-46373 via sqlfluff (0.6.9)

sqlfluff PYPI version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.19.1a7, =0.3.0a0, =0.8.0a0 Source cves: CVE-2026-46373 Source advisory: OSV:PYSEC-2026-209...

dbt-coves (>=0.19.1a7, <=0.21.0a1), jsqlib (>=0.3.0a0, <=0.8.0a0) potentially affected by CVE-2026-46374 via sqlfluff (0.6.9)

sqlfluff PYPI version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.19.1a7, =0.3.0a0, =0.8.0a0 Source cves: CVE-2026-46374 Source advisory: OSV:PYSEC-2026-210...

dbt-coves (>=0.21.0a2, <=0.21.0a16), dwhgen (0.1.0) +1 more potentially affected by CVE-2026-46373 via sqlfluff (0.7.1)

sqlfluff PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a2, =0.1.0, =0.14.0 Source cves: CVE-2026-46373 Source advisory: OSV:PYSEC-2026-209...

dbt-coves (>=0.21.0a2, <=0.21.0a16), dwhgen (0.1.0) +1 more potentially affected by CVE-2026-46374 via sqlfluff (0.7.1)

sqlfluff PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a2, =0.1.0, =0.14.0 Source cves: CVE-2026-46374 Source advisory: OSV:PYSEC-2026-210...

dbt-superset-lineage (>=0.1.0, <=0.2.1), dwhgen (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2026-46373 via sqlfluff (0.8.2)

sqlfluff PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-superset-lineage =0.1.0, =0.1.1, =0.1.5, =0.2.7 Source cves: CVE-2026-46373 Source advisory: OSV:PYSEC-2026-209...

dbt-superset-lineage (>=0.1.0, <=0.2.1), dwhgen (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2026-46374 via sqlfluff (0.8.2)

sqlfluff PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-superset-lineage =0.1.0, =0.1.1, =0.1.5, =0.2.7 Source cves: CVE-2026-46374 Source advisory: OSV:PYSEC-2026-210...

dbt-coves (0.21.0a17) potentially affected by CVE-2026-46373 via sqlfluff (0.9.3)

sqlfluff PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves 0.21.0a17 Source cves: CVE-2026-46373 Source advisory: OSV:PYSEC-2026-209...

dbt-coves (0.21.0a17) potentially affected by CVE-2026-46374 via sqlfluff (0.9.3)

sqlfluff PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves 0.21.0a17 Source cves: CVE-2026-46374 Source advisory: OSV:PYSEC-2026-210...

dbt-coves (>=0.21.0a18, <=0.21.1a20) potentially affected by CVE-2026-46373 via sqlfluff (0.9.4)

sqlfluff PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a18, =0.21.1a20 Source cves: CVE-2026-46373 Source advisory: OSV:PYSEC-2026-209...

dbt-coves (>=0.21.0a18, <=0.21.1a20) potentially affected by CVE-2026-46374 via sqlfluff (0.9.4)

sqlfluff PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a18, =0.21.1a20 Source cves: CVE-2026-46374 Source advisory: OSV:PYSEC-2026-210...

dbt-coves (>=1.0.4a27, <=1.1.1a0) potentially affected by CVE-2026-46373 via sqlfluff (0.11.2)

sqlfluff PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =1.0.4a27, =1.1.1a0 Source cves: CVE-2026-46373 Source advisory: OSV:PYSEC-2026-209...