SQLFluff, a SQL linter and formatter, contains a parser bug that allows an adversary to craft a query with exceptionally deep nesting. The recursive parsing logic can overflow the call stack, exhausting system resources and causing the application to halt, which manifests as a denial of service. The weakness is a classic stack overflow flaw, classified as CWE‑674.

The vulnerability is present in all installations of the sqlfluff module prior to version 4.1.0. Any instance that accepts SQL input from untrusted parties and passes it to the parser is affected. The fix is included beginning with the 4.1.0 release.

The CVSS score of 7.5 indicates a high severity and the lack of an EPSS value means current exploitation probability is unknown. Because untrusted users can submit arbitrary SQL, the attack vector is client‑initiated. The vulnerability is not listed in CISA’s KEV catalog, but its potential to crash services in production environments makes it a significant risk.