A sub-2MB valid SQL query drives SQLGlot past 1.5GB of memory in Imperva tests

Imperva's researchers wrote that the trigger is "Just normal-looking SQL that happens to be shaped in the wrong way." ^[2] The payloads contain neither injection nor malformed syntax ^[3]. A filter that looks for either one lets them through. According to Imperva, any database would reject a query nested that deeply as absurd, but the parser that sits in front of the database still tries to parse it ^[6]. Neither library limited recursion depth when Imperva tested it ^[5].

Width drives the memory failure as much as depth does. Tokenization first splits the payload into hundreds of thousands of pieces ^[11]. Each token, down to a single dot, then becomes a Python object holding type information, position tracking and a parent reference ^[10]. A compact query with thousands of columns and deep expression chains produces millions of tree nodes ^[12]. According to Imperva, the OOM killer then ends the process, or the process hangs and starves everything else on the machine ^[12].

I'd rate this as easy to trigger but narrow in reach. The attacker needs a text field that passes SQL to SQLGlot or SQLFluff, and a valid string to put in it ^[3]. Database permissions never come into play, because the parser runs before the query reaches the database ^[17].

Imperva also says these parsers increasingly sit inside LLM-integrated tools that generate SQL ^[19]. In those tools the parser stands between the database and whatever SQL it receives, whether a model wrote it or a user pasted it in ^[17][19]. The available text of the post shows SQL being submitted directly. It does not show a model being steered into writing the payload, and it does not say whether the Superset route needs a logged-in user.

The findings come from Imperva's own testing of the two libraries ^[1]. Until a deployment picks up the upstream fix, the stopgap is the one Imperva proposes for the parsers themselves: a hard nesting limit of around 30 levels and a graceful abort ^[7]. A depth cap does not limit column count, so the memory case stays open ^[12].