Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

Snowflake Python connector can be crashed by crafted input

CVE-2022-42965 · published 3 years ago
Summary

The Snowflake connector library for Python can be forced to consume excessive processing time if an attacker supplies specially crafted data to an internal function. This can slow down or stop applications that use the connector, potentially causing a denial of service. Update to the latest version of the snowflake-connector-python package or apply the vendor’s recommended patch to mitigate the risk.

What to do
  • Update snowflake snowflake-connector-python to version 2.8.2.
  • Update snowflake snowflake_connector to version 2.8.2 or later.
Affected software
Ecosystem VendorProductAffected versions
pip snowflake snowflake-connector-python < 2.8.2
Fix: upgrade to 2.8.2
– snowflake snowflake_connector < 2.8.2
cpe:2.3:a:snowflake:snowflake_connector:*:*:*:*:*:python:*:*
Original advisory text
Exponential ReDoS in snowflake-connector-python leads to denial of service
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published9 Nov 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-4r6j-fwcx-94cf · GHSA
CVE-2022-42965 · NVD
CVE-2022-42965 · OSV
Track software like this
Free during beta