Retrying of malformed requests

Low3.3CVE-2025-46330 · Published Apr 28, 2025

# Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for C/C++ (“Connector”). Malformed requests that caused the HTTP response status code 400 were incorrectly treated as retryable. This could hang the application until SF_CON_MAX_RETRY requests were sent. This vulnerability affects Connector versions 0.5.0 through 2.1.0. Snowflake fixed the issue in version 2.2.0. # Vulnerability Details The HTTP response status code 400 was incorrectly treated by the Connector as a retryable error. This caused malformed requests to be retried SF_CON_MAX_RETRY times (by default 7), hanging the application until all attempts were exhausted. # Solution Snowflake released version 2.2.0 of the Snowflake Connector for C/C++, which fixes this issue. We recommend users upgrade to version 2.2.0. # Additional Information If you discover a security vulnerability in one of our products or websites, please report the issue to Snowflake through our Vulnerability Disclosure Program hosted at HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).