Your message dated Sun, 20 Sep 2026 12:49:16 +0000
with message-id <[email protected]>
and subject line Bug#1139640: fixed in sqlfluff 4.3.0-1
has caused the Debian Bug report #1139640,
regarding sqlfluff: CVE-2026-46373 CVE-2026-46374
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1139640: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139640
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: sqlfluff
Version: 3.5.0-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for sqlfluff.
CVE-2026-46373[0]:
| SQLFluff is a modular SQL linter and auto-formatter with support for
| multiple dialects and templated code. Prior to version 4.1.0, in
| deployments where untrusted users can provide SQL queries to be
| linted, an untrusted user can submit a malicious query with
| deliberate excessive nesting to any application using the parser to
| trigger a Denial of Service through resource exhaustion. This issue
| has been patched in version 4.1.0.
CVE-2026-46374[1]:
| SQLFluff is a modular SQL linter and auto-formatter with support for
| multiple dialects and templated code. Prior to version 4.2.0, in
| deployments where untrusted users can provide SQL queries to be
| linted, an untrusted user can submit a malicious long query to any
| application using the parser to trigger a Denial of Service through
| resource exhaustion. This issue has been patched in version 4.2.0.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-46373
https://www.cve.org/CVERecord?id=CVE-2026-46373
https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-wmhf-fqc8-vxhh
[1] https://security-tracker.debian.org/tracker/CVE-2026-46374
https://www.cve.org/CVERecord?id=CVE-2026-46374
https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-73jc-5mrq-prw7
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: sqlfluff
Source-Version: 4.3.0-1
Done: Alexandre Detiste <[email protected]>
We believe that the bug you reported is fixed in the latest version of
sqlfluff, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Alexandre Detiste <[email protected]> (supplier of updated sqlfluff package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 20 Sep 2026 13:04:40 +0200
Source: sqlfluff
Architecture: source
Version: 4.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <[email protected]>
Changed-By: Alexandre Detiste <[email protected]>
Closes: 1139640
Changes:
sqlfluff (4.3.0-1) unstable; urgency=medium
.
* Team upload.
* New upstream version 4.3.0 (Closes: #1139640)
- CVE-2026-46373: malicious input can lead to DoS
- CVE-2026-46374: malicious input can lead to DoS
* Sync d/salsa-ci.yml with d/control
* Rewrite d/watch in v5 format
* Switch to debhelper-compat 14
Checksums-Sha1:
520c83af0358492a5a726a4bc5f0493d64c81dd9 3950 sqlfluff_4.3.0-1.dsc
6a2a798c9c8f8d0388bde623c9dab523a4bbbf64 4260425 sqlfluff_4.3.0.orig.tar.gz
a6e9dc877a13b6a611967d93cfedb3068e8cb12b 9900 sqlfluff_4.3.0-1.debian.tar.xz
5f272dc02eb615121b0eb5f776a2b94c31ece8d3 8026 sqlfluff_4.3.0-1_source.buildinfo
Checksums-Sha256:
ac68bf3a5c52ec23a29e10fe9fa000b3f3036e27ec0b838a35cae8b967daa642 3950
sqlfluff_4.3.0-1.dsc
354cd0e99f04bc83e8c0bab441ea6e2fd425f3dfaefa486558244b994bd2a5dd 4260425
sqlfluff_4.3.0.orig.tar.gz
085fbe7a094056b1e03a009066e71393aadc5f5f2571548035dee83c3168d155 9900
sqlfluff_4.3.0-1.debian.tar.xz
62d94862506b4afb917871163981747d5c60e06c8d7addf3b54510408179a272 8026
sqlfluff_4.3.0-1_source.buildinfo
Files:
b09d9b5a94193cbee830bf8d5539f353 3950 python optional sqlfluff_4.3.0-1.dsc
671b5f784b1a870d9b31d4917a44774f 4260425 python optional
sqlfluff_4.3.0.orig.tar.gz
15b5048b138a1cd3f95ba0f93a2c053d 9900 python optional
sqlfluff_4.3.0-1.debian.tar.xz
b352b6c5dd3580d75a7485eb6da61677 8026 python optional
sqlfluff_4.3.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmqv0HoRHHRjaGV0QGRl
Ymlhbi5vcmcACgkQMfMURUShdBp1KA/+I0Gfu0ukJo1RN/BRWMwgNAz7oWK9in03
lPx+7RcYt/Pony1zDXu5A82A3CW1YEpRjdwpoOoZj6zTNL4x7qMH5dpx4WIZ958d
bTGCzWJUvhFD+s7+pdlFaZDJf4PVLIFWv3ItyOpKvgRWWJ2vrT1FNIa+cpT+Gqt6
ep0s1743MVuA3rbEQB9THrX4wcGgRyJTV6VULZ3Y+AADES1LMq/v8ZESP7r66Gc4
zxSdR3oGjGme2dbDJ93I2egGHoLUlNk2tRP8D9rlghSV6JN823P/1foLbDMgtKmj
eFatmZKzpCGeo+iaBKOfIjZlaHtyuw4D2VAFAPnBvI2Lw9v+DgTPA7rIpoqSdZC9
MjY2P770YDJNuW5lSOquKy012NPLVqeQo360N+FYXZn0Tv4rBZNFCwxhYFIrAq/5
xs7ySMNZOBV4uQyeOC7bxvBAvPxo/995QFde8m40hbNDtd5wWZH6VrUy7mku1enw
qPvJ8bPMJybwMfmQ5XOHH1fbYLt/FlCdgQWTZsQyF2oH1IHzjPu3z2PGYKa5JwG3
ZeKZQ7YdWTuAywoBXnCjl+0fDOhAdG9m0g3S0uHG+brQycffcez5qxcd9kJPzYD9
M25nmxS+jLjg6ZpkU/j4+puGF4UoNmvXuafSO0a8YnUY7f/XvNuvig711xPYVGVr
RnHaSX1ygek=
=bOIl
-----END PGP SIGNATURE-----
pgpJGajc0w5SU.pgp
Description: PGP signature
--- End Message ---
