CVE-2026-3293mediumCWE-1333CWE-400

CVE-2026-3293: medium-severity vulnerability in snowflakedb snowflake-jdbc

snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos

Published

Follow this CVE+ Monitor snowflake-jdbc+ Monitor net.snowflake:snowflake-jdbc

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.3%
A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts can lead to inefficient regular expression complexity. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 5fb0a8a318a2ed87f4022a1f56e742424ba94052. A patch should be applied to remediate this issue.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
snowflakedb · snowflake-jdbc
Related CVEs — snowflakedb snowflake-jdbc

In the same product, most dangerous first.

CVE-2023-30535HIGHSnowflake JDBC vulnerable to command injection via SSO URL authenticationEPSS 1.7%CVE-2025-24789HIGHSnowflake JDBC allows an untrusted search path on WindowsEPSS 0.3%CVE-2025-24790MEDIUMSnowflake JDBC uses insecure temporary credential cache file permissionsEPSS 0.2%CVE-2025-27496LOWSnowflake JDBC Driver client-side encryption key in DEBUG logsEPSS 0.1%