We disclosed four vulnerabilities in the widely used SQL parsers SQLGlot and SQLFluff, as well as issues affecting downstream applications such as Apache Superset (70k GitHub stars), Pathway (60k GitHub stars), and other tools that rely on these parsers. Some of these downstream vulnerabilities have also been disclosed.
These flaws allow syntactically valid queries to trigger crashes or out-of-memory errors via recursion and AST object inflation. Our findings demonstrate that even well-formed queries can be weaponized to disrupt data workflows. We provide practical mitigations to help maintainers and platform builders strengthen parsers against this class of attacks.
