Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner

The vulnerability lies in the way the Snowflake JDBC Driver handles the nonProxyHosts argument within the SdkProxyRoutePlanner function. An attacker, operating locally, can craft a malicious input that triggers an inefficient regular expression. This can lead to excessive CPU usage and potentially denial of service, as the system struggles to process the complex regex. While the impact is considered LOW due to the local execution requirement, the potential for resource exhaustion warrants prompt remediation. The availability of a public exploit increases the risk of exploitation.

Organizations utilizing Snowflake JDBC Driver versions 4.0.1 and earlier are at risk. This includes applications directly interacting with Snowflake databases using the JDBC driver, particularly those with local access to the driver's execution environment. Shared hosting environments where multiple applications share the same JDBC driver instance are also at increased risk.

• java / application: Monitor CPU usage and memory consumption of the Snowflake JDBC Driver process. Look for unusual spikes that correlate with JDBC connection activity.

ps aux | grep snowflake-jdbc | awk '{print $3, $4}'

• java / application: Analyze application logs for errors related to regular expression processing or JDBC connection failures. • generic web: If the JDBC driver is used in a web application, monitor web server logs for unusual patterns or errors related to JDBC connections. • database (mysql, redis, mongodb, postgresql): While not directly impacting these databases, monitor the Snowflake instance for increased resource usage that might be triggered by malicious JDBC connections.

1. 2026-02-27Disclosure

   disclosure

1. Réservé2026-02-26
2. Publiée2026-02-27
3. Modifiée2026-03-04
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-3293 is to upgrade to a patched version of the Snowflake JDBC Driver. The patch identifier is 5fb0a8a318a2ed87f4022a1f56e742424ba94052. Before upgrading, assess the potential impact on existing applications and consider a staged rollout. If an immediate upgrade is not feasible, consider implementing input validation on the nonProxyHosts parameter to restrict the complexity of the provided values. After upgrade, confirm the fix by attempting to trigger the vulnerable function with a complex nonProxyHosts value and verifying that it does not result in excessive resource consumption.