Update:

[HIGH] GHSA-wmhf-fqc8-vxhh: SQLFluff: Recursive Stack Overflow in Parser

GitHub Security Advisory·Security·SecurityFix·5/19/2026

### Impact In deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion. ### Patches Versions 4.1.0 and up

Why it matters → sqlfluff released an update. Review the changelog for relevant changes.

Who should care → Teams using sqlfluff.

sqlfluff

View original source ↗

Source payload preview

{
  "ghsaId": "GHSA-wmhf-fqc8-vxhh",
  "summary": "SQLFluff: Recursive Stack Overflow in Parser",
  "severity": "HIGH",
  "updatedAt": "2026-05-19T20:10:19Z",
  "references": [
    {
      "url": "https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-wmhf-fqc8-vxhh"
    },
    {
      "url": "https://github.com/advisories/GHSA-wmhf-fqc8-vxhh"
    }
  ],
  "description": "### Impact\n\nIn deployments where untrusted users can provide SQL queries to be linted, an untrusted user can submit a malicious query with deliberate excessive nesting to any application using the parser to trigger a Denial of Service through resource exhaustion.\n\n### Patches\n\nVersions 4.1.0 and up contain a configurable recursion limit, which is enabled by default, to prevent this manner of exploit.\n\n### C
…