7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46373

CVE-2026-46373: SQLFluff: Recursive Stack Overflow in Parser

SQLFluff is a modular SQL linter and auto-formatter with support for multiple dialects and templated code. Prior to version 4.1.0, in deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion. This issue has been patched in version 4.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46373

CVE-2026-46373:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sqlfluff	pip	< 4.1.0	4.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, a recursive stack overflow in the SQLFluff parser, is caused by uncontrolled recursion when parsing deeply nested SQL queries. The analysis of the security patches reveals that the core issue was the lack of a depth limit in the parsing logic, both in the Python implementation and the optional Rust-based parser.

The patch introduces a new configuration parameter, max_parse_depth, which defaults to 255. This limit is enforced in the key recursive and iterative parts of the parser.

Three main areas were identified as vulnerable:

Bracket Matching (resolve_bracket): The Python function for parsing nested brackets was purely recursive. The patch wraps the recursive call in a new context manager (deeper_match) that tracks and limits the recursion depth.
General Grammar Matching (BaseGrammar.match via deeper_match): The fundamental parsing mechanism involves grammar objects recursively calling match on sub-grammars. The deeper_match context manager was introduced as a central fix to track depth across all grammar matching, preventing stack overflow from any form of deeply nested grammar structure (e.g., nested CASE statements, subqueries, etc.).
Rust Parser (Parser.call_rule_as_root): The Rust parser uses an iterative, stack-based approach to avoid native recursion limits. However, this simulated stack could still grow without bounds. The patch adds a check within the main parsing loop to limit the size of this stack, effectively mitigating the same denial-of-service vector.

By identifying these functions, a security engineer can understand that any interaction with the SQLFluff parsing engine, when fed a malicious query, could have triggered this vulnerability. The runtime profile during an exploit would show deep call stacks involving resolve_bracket and various match methods, or high memory usage by the Rust parser's internal stack, until the process crashes.

Vulnerable functions

resolve_bracket

src/sqlfluff/core/parser/match_algorithms.py

This function is used to find matching brackets in SQL statements. It uses recursion to handle nested brackets. Before the patch, there was no limit on the recursion depth, allowing a deeply nested bracketed expression to cause a stack overflow.

deeper_match

src/sqlfluff/core/parser/context.py

This function, introduced in the patch, is a context manager that increments and checks the parsing depth against a configured limit (`max_parse_depth`). The vulnerability is not in this function itself, but in the parsing functions that, prior to the patch, would recursively call each other without any depth-checking mechanism. This function is the mitigation for that vulnerability.

Parser.call_rule_as_root

sqlfluffrs/sqlfluffrs_parser/src/parser/core.rs

This is the entry point for the Rust-based parser. It uses an iterative approach with a stack to parse the SQL. The vulnerability existed because there was no limit on the size of this simulated stack, allowing a malicious query with deep nesting to exhaust resources. The function that contains this iterative loop is effectively the vulnerable component.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.