SQLFluff: Uncontrolled Resource Consumption in SQLFluff Parser

Vulnerability

SQLFluff is a SQL linter and formatter. In versions prior to 4.2.0, the parser does not limit the number of parse nodes, allowing an attacker to submit a crafted long SQL query that causes excessive resource consumption. This affects any application that exposes the parser to untrusted user input. [1][2]

Exploitation

An attacker needs only network access to submit a malicious SQL query to an application using the vulnerable parser. No authentication or special privileges are required. The attacker crafts a long query that triggers deep parsing, exhausting CPU and memory resources. [2][3]

Impact

Successful exploitation leads to denial of service (availability impact) as the parser consumes excessive resources, potentially causing the application to become unresponsive or crash. No confidentiality or integrity impact is reported. [2][3]

Mitigation

The fix is included in SQLFluff version 4.2.0, which introduces a configurable parse node limit enabled by default. Users should upgrade to 4.2.0 or later. No workaround is available for earlier versions. [2][3]