CVE-2026-3293: snowflake snowflake_jdbc Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-3293 is a medium (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in snowflake snowflake_jdbc. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 27-02-2026PublishedVulnerability first disclosed.
- 27-02-2026Last modifiedVulnerability information updated.
Description
A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts can lead to inefficient regular expression complexity. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 5fb0a8a318a2ed87f4022a1f56e742424ba94052. A patch should be applied to remediate this issue.
CVSS metrics
9 scores · 3 sources · 4 versions- OSV · MavenEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- CVE.orgCNA3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:CDiffers
- OSV · MavenEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- NVDNIST1.7LowAV:L/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
-0.01 pp
From 0.21% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSnowflake Jdbc
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected systems
Net.snowflake1 product
- snowflake-jdbc≤ 4.0.1
Snowflake1 product
- snowflake_jdbc< 4.0.1
Snowflakedb1 product
- snowflake-jdbc4.0.0 | 4.0.1
3 vendors · 3 products
