SQLFluff: Recursive Stack Overflow in Parser
Impact
In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion.
Patches
Versions 4.1.0 and up contain a configurable recursion limit, which is enabled by default, to prevent this manner of exploit.
Credit
Ori Nakar from Imperva Threat Research Team.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | sqlfluff | < 4.1.0 | 4.1.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-674- Platform
- Python (PyPI)
- Package
sqlfluff- Disclosed
- 19.05.2026
- Updated
- 11.10.2026 13:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-209 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-wmhf-fqc8-vxhh - CC BY 4.0
Vulnerability history: sqlfluff
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 07.2023 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 1
Disclosures per year
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 2
-
SQLFluff: Recursive Stack Overflow in Parser this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.