CVE-2026-3293: 
Java vulnerability analysis and mitigation

CVE-2026-3293 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Snowflake JDBC driver (snowflake-jdbc) affecting all versions up to and including 4.0.1. The flaw resides in the SdkProxyRoutePlanner function within src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java, where attacker-controlled input passed via the nonProxyHosts JDBC connection parameter is used directly in regex matching without sanitization, enabling catastrophic backtracking. It was reported on February 17, 2026, publicly disclosed on February 27, 2026, and a patch was merged shortly thereafter. The CVSS v3.1 base score is 5.5 (Medium) per NVD, while the CNA (VulDB) rates it 3.3 (Low) (GitHub Issue, GitHub Advisory, Red Hat Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity). In SdkProxyRoutePlanner.doesTargetMatchNonProxyHosts(), the hostPatterns array is populated from the user-supplied nonProxyHosts parameter with only * replaced by .*?, leaving all other regex metacharacters (e.g., +, ()) intact and interpreted by the Java regex engine. The targetHost value is derived from the JDBC URL host component, meaning both the regex pattern and the matched string are attacker-controlled — a prerequisite for classic ReDoS payload construction. A secondary affected path exists in ProxyConfig.isBypassProxy(), which compiles nonProxyHosts entries directly via Pattern.compile() after only escaping . and *, leaving other metacharacters exploitable. The fix (commit 5fb0a8a) introduces a globToSafePattern() utility that splits on * and quotes all literal segments via Pattern.quote(), preventing any regex metacharacters from being interpreted (GitHub Issue, Patch Commit).

Successful exploitation causes a Denial of Service via CPU exhaustion on the host running the vulnerable JDBC driver, as the Java regex engine enters catastrophic backtracking when evaluating the crafted pattern against the crafted hostname. There is no confidentiality or integrity impact — the vulnerability is availability-only. The attack is particularly relevant in multi-tenant platforms, SaaS environments, or any system that processes untrusted JDBC URLs or user-supplied connection configurations, where a low-privileged local user could render the JDBC connection handler unresponsive (GitHub Issue, Feedly).

1. Identify a target: Locate a system running Snowflake JDBC driver version ≤ 4.0.1 where an attacker has local access and can supply or influence JDBC connection parameters (e.g., a multi-tenant platform accepting user-provided JDBC URLs).
2. Craft a malicious JDBC URL: Construct a URL with a long repeating hostname and a ReDoS-triggering nonProxyHosts pattern, for example:

   jdbc:snowflake://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaac/?account=foo&user=u&password=p&useProxy=true&proxyHost=127.0.0.1&proxyPort=8080&nonProxyHosts=(a%2B)%2B

   The decoded nonProxyHosts value (a+)+ is a classic catastrophic backtracking pattern.
3. Trigger connection initialization: Execute DriverManager.getConnection(url) using the crafted URL. During connection setup, SdkProxyRoutePlanner.doesTargetMatchNonProxyHosts() evaluates the malicious regex against the crafted hostname.
4. Achieve CPU exhaustion: The Java regex engine enters exponential backtracking, causing CPU utilization to spike to 100% and rendering the JDBC handler unresponsive (Denial of Service). Multiple patterns can be chained via | (e.g., (a+)+|(b+)+) to amplify the effect (GitHub Issue).

• Process: Java process (running the Snowflake JDBC driver) consuming 100% CPU for an extended or indefinite period during connection initialization.
• Logs: Application logs showing JDBC connection attempts that hang or time out during proxy route planning; stack traces originating from SdkProxyRoutePlanner.doesTargetMatchNonProxyHosts() or ProxyConfig.isBypassProxy().
• Network: JDBC connection requests to Snowflake endpoints that never complete or are abnormally delayed, potentially accompanied by proxy configuration parameters in connection strings.
• Configuration/Input: Presence of regex metacharacters (e.g., (, ), +) in the nonProxyHosts JDBC connection parameter, or unusually long hostnames in JDBC URLs supplied by users (GitHub Issue).

Upgrade the Snowflake JDBC driver to a version beyond 4.0.1 (the fix was merged into the codebase as commit 5fb0a8a318a2ed87f4022a1f56e742424ba94052 and is included in subsequent releases). As a workaround where immediate upgrade is not possible, restrict local access to systems running the vulnerable driver to only trusted users, and avoid accepting user-supplied JDBC URLs or nonProxyHosts parameters from untrusted sources. IBM watsonx.data users should refer to the IBM security bulletin for affected product versions and remediation guidance (Patch Commit, GitHub Advisory, IBM Advisory).

The vulnerability was originally reported by researcher "Fushuling" via the GitHub issue tracker on February 17, 2026, after an initial submission to HackerOne was rejected. The Snowflake driver team acknowledged and triaged the issue, merging a fix promptly. Red Hat and IBM both issued advisories noting the impact on their products (Red Hat CVE tracking and IBM watsonx.data). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (GitHub Issue, Red Hat Advisory, IBM Advisory).