SQLFluff’s parser consumes an unbounded amount of resources when it processes an excessively long query. The bug allows a malicious query to exhaust memory and CPU, resulting in an application or service crash or unresponsive state. The weakness is a classic resource exhaustion flaw, classified as CWE-400, and its primary consequence is the loss of service availability.

Any installation of SQLFluff prior to version 4.2.0 that accepts user‑supplied SQL for linting or formatting is affected. This includes all projects, frameworks, or tools that depend on the older SQLFluff library, regardless of the SQL dialect or templating engine used.

The CVSS score of 7.5 marks this issue as high, and the lack of an EPSS score or KEV listing means no published exploitation statistics are available. Attackers who can submit SQL queries – for example, through a public linting API, a web interface, or a continuous‑integration pipeline – can trigger the denial of service by sending a query that is far larger than the typical expected size. The vulnerability has already been patched in 4.2.0, so the risk is mitigated by upgrading.