VulnerabilityAnalyzed

CVE-2025-46330

libsnowflakeclient is the Snowflake Connector for C/C++.

LOW 3.3EPSS 0.16%

Does this matter?

Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.

Description

libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, incorrectly treat malformed requests that caused the HTTP response status code 400, as able to be retried. This could hang the application until SF_CON_MAX_RETRY requests were sent. This issue has been patched in version 2.2.0.

CVSS 3.1: 3.3 LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.16% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-573
Affected: snowflake/connector for c\/c\+\+
Source: security-advisories@github.com

References

https://github.com/snowflakedb/libsnowflakeclient/pull/882/commits/8120a057e041722e114ed2c5dbed3b5a649f72e2Patch
https://github.com/snowflakedb/libsnowflakeclient/security/advisories/GHSA-ch37-53v3-m4cmVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.