By vendor

Sqlfluff vulnerabilities

Known CVEs affecting Sqlfluff products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-46373HIGH 7.5

  SQLFluff, a popular SQL linter and code formatter, contains a denial-of-service vulnerability in versions before 4.1.0. An attacker who can submit SQL queries to an application using SQLFluff's parser can craft a specially nested query to exhaust system resources, causing the application to become unresponsive or crash. This affects any deployment where untrusted users have the ability to lint arbitrary SQL code.

• CVE-2026-46374HIGH 7.5

  SQLFluff, a widely-used SQL linter and formatter, contains a denial-of-service vulnerability affecting versions prior to 4.2.0. An attacker who can submit SQL queries to an application using SQLFluff's parser can trigger resource exhaustion by crafting an exceptionally long query, causing the service to become unavailable. This risk is most acute in environments where untrusted users have direct access to linting functionality—such as shared development platforms, online SQL validators, or multi-tenant SaaS tools.