Snowflake JDBC Driver 存在通过 SdkProxyRoutePlanner 的不可控资源消耗漏洞

该漏洞允许攻击者通过构造恶意的 nonProxyHosts 参数，触发正则表达式引擎的过度计算，导致系统资源耗尽，进而影响应用程序的性能和可用性。虽然该漏洞仅能本地执行，但如果攻击者能够获得本地访问权限，例如通过恶意代码注入或配置错误，则可能利用该漏洞进行拒绝服务攻击或进一步的渗透。该漏洞的公开 PoC 意味着攻击者可以轻松地利用该漏洞，因此需要尽快采取措施进行修复。

Organizations utilizing Snowflake JDBC Driver versions 4.0.1 and earlier are at risk. This includes applications directly interacting with Snowflake databases using the JDBC driver, particularly those with local access to the driver's execution environment. Shared hosting environments where multiple applications share the same JDBC driver instance are also at increased risk.

• java / application: Monitor CPU usage and memory consumption of the Snowflake JDBC Driver process. Look for unusual spikes that correlate with JDBC connection activity.

ps aux | grep snowflake-jdbc | awk '{print $3, $4}'

• java / application: Analyze application logs for errors related to regular expression processing or JDBC connection failures. • generic web: If the JDBC driver is used in a web application, monitor web server logs for unusual patterns or errors related to JDBC connections. • database (mysql, redis, mongodb, postgresql): While not directly impacting these databases, monitor the Snowflake instance for increased resource usage that might be triggered by malicious JDBC connections.

1. 2026-02-27Disclosure

   disclosure

1. 已保留2026-02-26
2. 发布日期2026-02-27
3. 修改日期2026-03-04
4. EPSS 更新日期2026-03-23

为了缓解 CVE-2026-3293 带来的风险，建议立即升级到 Snowflake JDBC 驱动程序 4.0.2 或更高版本，该版本包含了修复补丁 5fb0a8a318a2ed87f4022a1f56e742424ba94052。如果无法立即升级，可以考虑限制对 JDBC 驱动程序的访问权限，并对 nonProxyHosts 参数进行严格的输入验证，以防止恶意参数的注入。此外，监控系统资源使用情况，及时发现并处理异常情况。