Executive brief
sqlparse is a Python SQL parsing library used in web-based SQL formatters, Django debug toolbars, and metadata extraction tools. The parser's grouping logic performs wasteful subtree traversals during construction of nested SQL structures, allowing an attacker to submit a small malicious SQL query (1-2 KB) that consumes 10+ seconds of CPU on a single server worker. This enables denial-of-service attacks: one request locks a worker, and multiple concurrent requests exhaust a multi-worker deployment.
Technical details
The vulnerability exists in sqlparse/sql.py TokenList.__init__, which calls super().__init__(None, str(self)) to materialize the cached value field. TokenList.__str__ recursively flattens the entire token subtree via the flatten() method. During nested SQL grouping (parentheses, CASE WHEN, subqueries, ARRAY literals), a new TokenList is constructed for each group, and each construction triggers a full subtree walk. For a parse tree of depth d with n total tokens, this results in O(n*d) flatten work, causing quadratic complexity independent of the existing MAX_GROUPING_DEPTH=100 and MAX_GROUPING_TOKENS=10000 caps. Entry points sqlparse.parse(), sqlparse.format(reindent=True), and sqlparse.split() are vulnerable by default. The exploit requires only sending the malicious SQL to an application that processes user input; no authentication or special configuration is needed. Fix is available in version 0.6.0, replacing the eager str(self) materialization with a linear-time concatenation of already-cached child values.
Affected products
- sqlparse sqlparse <= 0.5.5
Timeline
- 2026-08-13: disclosed
- 2026-08-17: advisory
- 2026-08-17: patched: Fixed in version 0.6.0