Threats affecting pkg:brew/sqlfluff

CVE-2026-46374 is a vulnerability in SQLFluff parser versions from 0.8.2 up to but not including 4.2.0 that allows an untrusted user to cause a Denial of Service (DoS) by submitting a maliciously long SQL query. This triggers uncontrolled resource consumption during parsing. The issue is addressed in version 4.2.0 and later, which introduces a configurable parse node limit enabled by default to prevent such exploits.

SQLFluff versions prior to 4.1.0 have a vulnerability where an attacker can cause a denial of service by submitting SQL queries with excessive nesting, leading to recursive stack overflow in the parser. This affects deployments that lint SQL queries from untrusted users. The issue is fixed in version 4.1.0 by introducing a configurable recursion limit enabled by default.