PT-2026-22301 · Snowflake · Snowflake-Jdbc

Fushuling · Published 2026-02-27 · Updated 2026-02-27 · CVE-2026-3293

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions snowflakedb snowflake-jdbc versions up to 4.0.1

Description A weakness exists in the SdkProxyRoutePlanner function within the JDBC URL Handler component of snowflakedb snowflake-jdbc. Manipulation of the nonProxyHosts argument can lead to inefficient regular expression complexity. This issue is locally exploitable and the exploit has been publicly released. The vulnerable code is located in the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java.

Recommendations Apply patch 5fb0a8a318a2ed87f4022a1f56e742424ba94052.

Exploit

Fix

Resource Exhaustion

DoS

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2026-3293

GHSA-GX6C-PV62-9MCF

Affected Products

Snowflake-Jdbc

References · 15

• 🔥 https://github.com/snowflakedb/snowflake-jdbc/issues/2505#issue-3951994646 · Exploit
• https://github.com/snowflakedb/snowflake-jdbc/issues/2505 · Vendor Advisory
• https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052 · Patch
• https://snowflakecomputing.atlassian.net/browse/SNOW-3104251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3293 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3293 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gx6c-pv62-9mcf · Vendor Advisory
• https://github.com/snowflakedb/snowflake-jdbc · Note
• https://t.me/CVEtracker/45940 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2027459343575081006 · Twitter Post
• https://vuldb.com/?submit.760428 · Note
• https://twitter.com/CVEnew/status/2027380194491634166 · Twitter Post
• https://vuldb.com/?id.348035 · Note
• https://t.me/cveNotify/153428 · Telegram Post
• https://vuldb.com/?ctiid.348035 · Note