Hi,

The following vulnerabilities were published for sqlfluff.

CVE-2026-46373[0]:
| SQLFluff is a modular SQL linter and auto-formatter with support for
| multiple dialects and templated code. Prior to version 4.1.0, in
| deployments where untrusted users can provide SQL queries to be
| linted, an untrusted user can submit a malicious query with
| deliberate excessive nesting to any application using the parser to
| trigger a Denial of Service through resource exhaustion. This issue
| has been patched in version 4.1.0.


CVE-2026-46374[1]:
| SQLFluff is a modular SQL linter and auto-formatter with support for
| multiple dialects and templated code. Prior to version 4.2.0, in
| deployments where untrusted users can provide SQL queries to be
| linted, an untrusted user can submit a malicious long query to any
| application using the parser to trigger a Denial of Service through
| resource exhaustion. This issue has been patched in version 4.2.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-46373
https://www.cve.org/CVERecord?id=CVE-2026-46373
https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-wmhf-fqc8-vxhh
[1] https://security-tracker.debian.org/tracker/CVE-2026-46374
https://www.cve.org/CVERecord?id=CVE-2026-46374
https://github.com/sqlfluff/sqlfluff/security/advisories/GHSA-73jc-5mrq-prw7

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
sqlfluff, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139640@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexandre Detiste <tchet@debian.org> (supplier of updated sqlfluff package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 20 Sep 2026 13:04:40 +0200
Source: sqlfluff
Architecture: source
Version: 4.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Alexandre Detiste <tchet@debian.org>
Closes: 1139640
Changes:
 sqlfluff (4.3.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 4.3.0 (Closes: #1139640)
     - CVE-2026-46373: malicious input can lead to DoS
     - CVE-2026-46374: malicious input can lead to DoS
   * Sync d/salsa-ci.yml with d/control
   * Rewrite d/watch in v5 format
   * Switch to debhelper-compat 14
Checksums-Sha1:
 520c83af0358492a5a726a4bc5f0493d64c81dd9 3950 sqlfluff_4.3.0-1.dsc
 6a2a798c9c8f8d0388bde623c9dab523a4bbbf64 4260425 sqlfluff_4.3.0.orig.tar.gz
 a6e9dc877a13b6a611967d93cfedb3068e8cb12b 9900 sqlfluff_4.3.0-1.debian.tar.xz
 5f272dc02eb615121b0eb5f776a2b94c31ece8d3 8026 sqlfluff_4.3.0-1_source.buildinfo
Checksums-Sha256:
 ac68bf3a5c52ec23a29e10fe9fa000b3f3036e27ec0b838a35cae8b967daa642 3950 sqlfluff_4.3.0-1.dsc
 354cd0e99f04bc83e8c0bab441ea6e2fd425f3dfaefa486558244b994bd2a5dd 4260425 sqlfluff_4.3.0.orig.tar.gz
 085fbe7a094056b1e03a009066e71393aadc5f5f2571548035dee83c3168d155 9900 sqlfluff_4.3.0-1.debian.tar.xz
 62d94862506b4afb917871163981747d5c60e06c8d7addf3b54510408179a272 8026 sqlfluff_4.3.0-1_source.buildinfo
Files:
 b09d9b5a94193cbee830bf8d5539f353 3950 python optional sqlfluff_4.3.0-1.dsc
 671b5f784b1a870d9b31d4917a44774f 4260425 python optional sqlfluff_4.3.0.orig.tar.gz
 15b5048b138a1cd3f95ba0f93a2c053d 9900 python optional sqlfluff_4.3.0-1.debian.tar.xz
 b352b6c5dd3580d75a7485eb6da61677 8026 python optional sqlfluff_4.3.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmqv0HoRHHRjaGV0QGRl
Ymlhbi5vcmcACgkQMfMURUShdBp1KA/+I0Gfu0ukJo1RN/BRWMwgNAz7oWK9in03
lPx+7RcYt/Pony1zDXu5A82A3CW1YEpRjdwpoOoZj6zTNL4x7qMH5dpx4WIZ958d
bTGCzWJUvhFD+s7+pdlFaZDJf4PVLIFWv3ItyOpKvgRWWJ2vrT1FNIa+cpT+Gqt6
ep0s1743MVuA3rbEQB9THrX4wcGgRyJTV6VULZ3Y+AADES1LMq/v8ZESP7r66Gc4
zxSdR3oGjGme2dbDJ93I2egGHoLUlNk2tRP8D9rlghSV6JN823P/1foLbDMgtKmj
eFatmZKzpCGeo+iaBKOfIjZlaHtyuw4D2VAFAPnBvI2Lw9v+DgTPA7rIpoqSdZC9
MjY2P770YDJNuW5lSOquKy012NPLVqeQo360N+FYXZn0Tv4rBZNFCwxhYFIrAq/5
xs7ySMNZOBV4uQyeOC7bxvBAvPxo/995QFde8m40hbNDtd5wWZH6VrUy7mku1enw
qPvJ8bPMJybwMfmQ5XOHH1fbYLt/FlCdgQWTZsQyF2oH1IHzjPu3z2PGYKa5JwG3
ZeKZQ7YdWTuAywoBXnCjl+0fDOhAdG9m0g3S0uHG+brQycffcez5qxcd9kJPzYD9
M25nmxS+jLjg6ZpkU/j4+puGF4UoNmvXuafSO0a8YnUY7f/XvNuvig711xPYVGVr
RnHaSX1ygek=
=bOIl
-----END PGP SIGNATURE-----