CVE-2026-3293

A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake/client/internal/core/SdkProxyRoutePlanner.java of the component JDBC URL Handler. Executing a manipulation of the argument nonProxyHosts can lead to inefficient regular expression complexity. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 5fb0a8a318a2ed87f4022a1f56e742424ba94052. A patch should be applied to remediate this issue.

• CWE-400
• CWE-1333

• https://github.com/snowflakedb/snowflake-jdbc/Product
• https://github.com/snowflakedb/snowflake-jdbc/commit/5fb0a8a318a2ed87f4022a1f56e742424ba94052Patch
• https://github.com/snowflakedb/snowflake-jdbc/issues/2505Exploit, Issue Tracking, Vendor Advisory
• https://github.com/snowflakedb/snowflake-jdbc/issues/2505#issue-3951994646Exploit, Issue Tracking, Vendor Advisory
• https://snowflakecomputing.atlassian.net/browse/SNOW-3104251Permissions Required, Vendor Advisory
• https://vuldb.com/?ctiid.348035Permissions Required, VDB Entry
• https://vuldb.com/?id.348035Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.760428Third Party Advisory, VDB Entry

Published

Feb 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32924OpenClaw before 2026.3.12 contains an authorization bypass v…9.8
• CVE-2026-32925V-SFT versions 6.2.10.0 and prior contain a stack-based buff…8.4
• CVE-2026-32926V-SFT versions 6.2.10.0 and prior contain an out-of-bounds r…5.5
• CVE-2026-32927V-SFT versions 6.2.10.0 and prior contain an out-of-bounds r…5.5
• CVE-2026-32928V-SFT versions 6.2.10.0 and prior contain a stack-based buff…8.4
• CVE-2026-32929V-SFT versions 6.2.10.0 and prior contain an out-of-bounds r…5.5
• CVE-2026-32930Chamilo LMS is a learning management system. Prior to 1.11.3…7.1
• CVE-2026-32931Chamilo LMS is a learning management system. Prior to 1.11.3…8.8
• CVE-2026-32932Chamilo LMS is a learning management system. Prior to 1.11.3…6.1
• CVE-2026-32933AutoMapper is a convention-based object-object mapper in .NE…7.5
• CVE-2026-32934CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-32935phpseclib is a PHP secure communications library. Projects u…5.9