CVE-2022-42965 Exponential ReDoS in snowflake-connector-python leads to denial of service

What is CVE-2022-42965?

CVE-2022-42965 is a low-severity denial of service vulnerability in snowflake-connector-python, published on 9 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method

Weakness: CWE-1333

Which versions are affected by CVE-2022-42965?

3 open source packages ship an affected version, including snowflake-connector-python. It affects 1 product.

Products include Snowflake Snowflake Connector.

How do I fix CVE-2022-42965?

Upgrade snowflake-connector-python to 2.8.2 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-42965 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-42965 exists.

Other vulnerabilities in snowflake-connector-python

• CVE-2023-34230 Snowflake Connector vulnerable to Command Injection High 7.3
• CVE-2023-34232 Snowflake NodeJS Driver vulnerable to Command Injection High 7.3
• CVE-2023-34233 Snowflake Python Connector vulnerable to Command Injection High 7.3
• CVE-2025-24793 Snowflake Connector for Python has an SQL Injection in write_pandas High 7.0
• CVE-2025-24794 The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4r6j-fwcx-94cf, PYSEC-2026-922.