CVE-2026-84305

UNKNOWN 0.0

sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.

CWE	CWE-407
Vendor	andialbrecht
Product	sqlparse
Published	Sep 1, 2026
Last Updated	Sep 1, 2026

Stay Ahead of the Next One

Get instant alerts for andialbrecht sqlparse

Be the first to know when new unknown vulnerabilities affecting andialbrecht sqlparse are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

andialbrecht / sqlparse

< 0.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm github.com: https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b github.com: https://github.com/andialbrecht/sqlparse/releases/tag/0.6.0