{"id":"CVE-2026-3293","summary":"snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos","details":"A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts can lead to inefficient regular expression complexity. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 5fb0a8a318a2ed87f4022a1f56e742424ba94052. A patch should be applied to remediate this issue.","aliases":["GHSA-gx6c-pv62-9mcf"],"modified":"2026-08-12T15:32:28.871910Z","published":"2026-02-27T05:32:09.400Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3293.json","cna_assigner":"VulDB","cwe_ids":["CWE-1333","CWE-400"]},"references":[{"type":"WEB","url":"https://github.com/snowflakedb/snowflake-jdbc/"},{"type":"WEB","url":"https://snowflakecomputing.atlassian.net/browse/SNOW-3104251"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3293.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3293"},{"type":"ADVISORY","url":"https://vuldb.com/?id.348035"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.760428"},{"type":"REPORT","url":"https://github.com/snowflakedb/snowflake-jdbc/issues/2505"},{"type":"REPORT","url":"https://github.com/snowflakedb/snowflake-jdbc/issues/2505#issue-3951994646"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.348035"},{"type":"FIX","url":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/snowflakedb/snowflake-jdbc","events":[{"introduced":"0"},{"fixed":"f86bc1e6d4da58446ab43e499973a6b4df6a3e23"},{"fixed":"5fb0a8a318a2ed87f4022a1f56e742424ba94052"}],"database_specific":{"cpe":"cpe:2.3:a:snowflake:snowflake_jdbc:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.0.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["4.0.0","4.0.1","v4.0.1","v4.0.0","v3.28.0","v3.27.1","v3.27.0","v3.26.1","v3.26.0","v3.25.1","v3.25.0","v3.24.2","v3.17.0","v3.18.0","v3.20.0","v3.21.0","v3.22.0","v3.24.1","v3.24.0","v3.23.2","v3.23.1","v3.23.0","v3.19.1","v3.19.0","v3.13.21","3.13.21","v3.13.33","v3.16.1","v3.16.0","v3.15.1","v3.15.0","v3.14.5","v3.14.4","v3.14.3","v3.14.2","v3.14.1","v3.14.0","v3.13.32","v3.13.31","v3.13.30","v3.13.29","v3.13.28","v3.13.27","v3.13.26","v3.13.25","v3.13.24","v3.13.23","v3.13.22","3.13.22","v3.13.20","v3.13.19","v3.13.18","v3.13.17","v3.13.16","v3.13.15","v3.13.14","v3.13.12","v3.13.13","v3.13.10","v3.13.9","v3.13.8","v3.13.7","v3.13.6","v3.13.5","v3.13.4","v3.13.3","v3.13.2","v3.13.1","v3.13.0","v3.12.16","v3.11.0","v3.12.14","v3.12.12","v3.12.11","v3.10.0","v3.12.9","v3.6.28","v3.12.7","v3.12.6","v3.12.5","v3.12.4","v3.12.3","v3.12.2","v3.12.1","v3.12.0","v3.11.1","v3.10.3","v3.10.2","v3.10.1","v3.9.2","v3.9.1","v3.9.0","v3.8.8","v3.8.7","v3.8.6","v3.8.5","v3.8.4","v3.8.3","v3.8.2","v3.8.1","v3.8.0","v3.7.2","v3.7.1","v3.7.0","v3.6.27","v3.6.26","v3.6.25","v3.6.24","v3.6.23","v3.6.21","v3.6.20","v3.6.19","v3.6.18","v3.6.17","v3.6.15","v3.6.14","v3.6.13","v3.6.11","v3.6.10","v3.6.9","v3.6.8","v3.6.6","v3.6.5","v3.6.4","v3.6.3","v3.6.2","v3.6.1","v3.6.0","v3.5.5","v3.5.4","v3.5.3","v3.5.2","v3.5.0","v3.4.3","v3.4.2","v3.4.1","v3.4.0","v3.3.3","v3.3.2","v3.3.1","v3.3.0","v3.2.7","v3.2.6","v3.2.5","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.1","v3.1.0","v3.0.21","v3.0.20","v3.0.19","v3.0.18","v3.0.17","v3.0.16","v3.0.15","v3.0.14","v3.0.13"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/main/java/net/snowflake/client/internal/jdbc/cloud/storage/S3HttpUtil.java"},"deprecated":false,"digest":{"line_hashes":["98477693419740486826957712217348434359","82388752944632142785033502266428954884","124187988953323007130402207391848211131","186474993618274287299012386049079391010","312312646365527404322896914180135652174","325549038367075644367925509952329109689","255399039998199395672082696711991477408","305065649275694115474792943262349361564","226912659264888484392334000460825646972","303937938665113039074778954084716776373","250746230361507854005867227835033378554"],"threshold":0.9},"id":"CVE-2026-3293-27c40f46","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/main/java/net/snowflake/client/internal/jdbc/SnowflakeUtil.java"},"deprecated":false,"digest":{"line_hashes":["244885537023776184185850032438339177370","259257079859437770703724871545529669461","248514767577989779532161164871408817789","2344940727235823154021134846492701899","62223394440168849998075205707702081178","197662254873979553785719445802126658586"],"threshold":0.9},"id":"CVE-2026-3293-2ea531a3","signature_type":"Line"},{"id":"CVE-2026-3293-4fc178ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/test/java/net/snowflake/client/internal/core/CoreUtilsMiscellaneousTest.java","function":"testSetProxyForS3"},"deprecated":false,"digest":{"function_hash":"162083954738160326919084260320140183570","length":586}},{"digest":{"line_hashes":["270357572742548676711794138946533381790","83061727286661362197141710829271203892","261708336061143522410073379744322435049","101381560256813163157404562199135006521","80291845650087338489093496899007967760","238917225933029533315058454618744900598","85764864249500544067776684157233737599","44859733766022032545935753252105822615","280126830185301262223118235189602261043","137404141965600136407332371881823715612","170183413106163612637332178491405078846","257572896659026778977038453223205331747","84966406784565192191916889214247519361"],"threshold":0.9},"id":"CVE-2026-3293-6db9c10e","signature_type":"Line","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/test/java/net/snowflake/client/internal/jdbc/cloud/storage/S3HttpUtilTest.java"},"deprecated":false,"digest":{"line_hashes":["150710249330310319602641167446527212744","151705557009477574602708845980076947144","142165455434711837628968605479515531423","251642673546880200507634366932168080229","118094635487905400785470259686636751021","155144157007750112799759935374567710352","310248221038735491443397475586103783242","330835924449485393715332068290496523197","40367210223239733107076327772486694043","46870592939078356281597760051405846482","256237840331900433633737684571292910295","57746455630195880778545432187230440095","15421140975661073386763218650279415313"],"threshold":0.9},"id":"CVE-2026-3293-7f5ca82d"},{"id":"CVE-2026-3293-80fdce99","signature_type":"Function","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"function":"testSetSessionlessProxyForS3","file":"src/test/java/net/snowflake/client/internal/core/CoreUtilsMiscellaneousTest.java"},"deprecated":false,"digest":{"function_hash":"164022317159229063471411955943676374916","length":1034}},{"digest":{"length":205,"function_hash":"212188797323627659532858199722420038941"},"id":"CVE-2026-3293-8ddd8972","signature_type":"Function","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java","function":"doesTargetMatchNonProxyHosts"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/test/java/net/snowflake/client/internal/jdbc/cloud/storage/S3HttpUtilTest.java","function":"prepareNonProxyHostsTestCases"},"deprecated":false,"digest":{"function_hash":"6415393895239304249452756048568119583","length":607},"id":"CVE-2026-3293-9432db27"},{"deprecated":false,"digest":{"line_hashes":["114805082251890104209774913076037701341","191216990538631794879668905007936200433","156181153140679460160061997505940707198","335786612396799193435577907368969365596","109560459784957183176816434909804887422","105655916224379560598219147910901223032","326046831149279907346844644442998723790","328663136170513646991356051206978487317","921720447972886077079655900905063401","329348859725081781053793841882930040821","25544083745999560938392007781416526847","6402617495146098457159209828566960693","155439255938143818536333288647132838617","336542424055428736233847952352198324978","97636490484108858435893484896376884816","285979680249187108709602120919795918076","219988266070240389265377887328453371784","20794298670793229839957562909308092696","69971968675305519773757264488910715309"],"threshold":0.9},"id":"CVE-2026-3293-ad4b0f1b","signature_type":"Line","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/test/java/net/snowflake/client/internal/core/CoreUtilsMiscellaneousTest.java"}},{"target":{"file":"src/main/java/net/snowflake/client/internal/jdbc/diagnostic/ProxyConfig.java","function":"isBypassProxy"},"deprecated":false,"digest":{"function_hash":"53846128629043549939252682252254124420","length":280},"id":"CVE-2026-3293-bfd05e4b","signature_type":"Function","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052"},{"deprecated":false,"digest":{"line_hashes":["249892423620943439165192050413885334576","199517825183868670158416618476079049363","201236737985784119931768373690989401134","327738433469571815560471684997036710823","171017120323870890205729113047410341871","162289490563098829921417209240337486974","274909432296768964931121450137421335887","18013210919410997390425341677738975191","245703041486866393713999441225590272787","102895572505141119349585122079311348797","181286707581312634379846071860272329591"],"threshold":0.9},"id":"CVE-2026-3293-cf6239fd","signature_type":"Line","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/main/java/net/snowflake/client/internal/jdbc/diagnostic/ProxyConfig.java"}},{"deprecated":false,"digest":{"function_hash":"238493824841700870031192054612929701804","length":482},"id":"CVE-2026-3293-dbbb85e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java","function":"SdkProxyRoutePlanner"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["52958290255638170744996982182790335764","257685468733477514644991889620029075212","295129759006749846717359642063827907330","105627018127337416567263568606718225783","247685854067005265290484853983130158715","311438997209130607952391071934850312886","17308007655812458356458926882025424010"]},"id":"CVE-2026-3293-e319ca63","signature_type":"Line","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/test/java/net/snowflake/client/internal/jdbc/SnowflakeUtilTest.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052","target":{"file":"src/main/java/net/snowflake/client/internal/jdbc/cloud/storage/S3HttpUtil.java","function":"prepareNonProxyHosts"},"deprecated":false,"digest":{"function_hash":"165183501062252587114589756144728407522","length":257},"id":"CVE-2026-3293-f2e95ebb"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3293.json","vanir_signatures_modified":"2026-08-12T15:32:28Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}