mediumVulnerability
CVE-2026-84305
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.
Properties
- severity
- medium
- summary
- sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
- epss_score
- 0.00189
- retrieved_at
- 2026-10-16T11:46:58+00:00
- ghsa_published
- 2026-09-01T21:20:11Z
- source_url
- https://github.com/advisories/GHSA-cfqr-cjx5-5jcm
- ghsa_updated
- 2026-09-01T21:21:22Z
- ghsa_id
- GHSA-cfqr-cjx5-5jcm
- last_source
- FIRST EPSS
- cve_id
- CVE-2026-84305
- signal_observed_at
- 2026-09-11T17:55:57+00:00
- is_ghsa_only
- false
- published_at
- 2026-09-01T19:17:30.887
- last_modified
- 2026-09-09T21:09:13.080
- epss_percentile
- 0.07954
Related Entities (6)
DESCRIBED_BY (1)
→[Source]NVD
ENRICHED_BY (1)
→[Source]FIRST EPSS
VULNERABLE_TO (1)
←[Software]pip/sqlparse
AFFECTS (1)
→[Software]pip/sqlparse
HAS_WEAKNESS (1)
→[Weakness]Inefficient Algorithmic Complexity
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph