The SQLFluff parser in versions before 4.2.0 does not limit the complexity or length of SQL queries it processes, enabling an attacker who can submit queries to cause excessive resource consumption leading to denial of service. This is classified under CWE-400 (Uncontrolled Resource Consumption). The vulnerability has a CVSS 3.1 vector indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only with high severity. The issue is fixed in version 4.2.0 by adding a default-enabled configurable parse node limit to prevent resource exhaustion.

An attacker able to submit SQL queries to an application using the vulnerable SQLFluff parser can cause denial of service by exhausting system resources. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild at this time.

Upgrade SQLFluff to version 4.2.0 or later, which includes a default-enabled configurable parse node limit to prevent resource exhaustion attacks. No additional mitigation is required if using these fixed versions.