CVE-2026-54284: sqlparse TokenList CPU denial of service

CVE-2026-54284 · Severity: high · CVSS 4 · Published 2026-08-17

sqlparse is a Python SQL parsing library used in web-based SQL formatters, Django debug toolbars, and metadata extraction tools. The parser's grouping logic performs wasteful subtree traversals during construction of nested SQL structures, allowing an attacker to submit a small malicious SQL query (1-2 KB) that consumes 10+ seconds of CPU on a single server worker. This enables denial-of-service attacks: one request locks a worker, and multiple concurrent requests exhaust a multi-worker deployment.

Technologies: sqlparse (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54284 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54284 being exploited in the wild.
How severe is CVE-2026-54284?
High severity, with a CVSS score of 4, published 17 August 2026.
Which products and versions are affected?
sqlparse (PyPI) <= 0.5.5, ECOSYSTEM:introduced=0,fixed=0.6.0.
Is there a fix for CVE-2026-54284?
Yes. sqlparse (PyPI): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54284 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54284?
Check whether you run sqlparse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sqlparse (PyPI): upgrade to 0.6.0 or later
    pip install "sqlparse>=0.6.0"

Technical details

The vulnerability exists in sqlparse/sql.py TokenList.__init__, which calls super().__init__(None, str(self)) to materialize the cached value field. TokenList.__str__ recursively flattens the entire token subtree via the flatten() method. During nested SQL grouping (parentheses, CASE WHEN, subqueries, ARRAY literals), a new TokenList is constructed for each group, and each construction triggers a full subtree walk. For a parse tree of depth d with n total tokens, this results in O(n*d) flatten work, causing quadratic complexity independent of the existing MAX_GROUPING_DEPTH=100 and MAX_GROUPING_TOKENS=10000 caps. Entry points sqlparse.parse(), sqlparse.format(reindent=True), and sqlparse.split() are vulnerable by default. The exploit requires only sending the malicious SQL to an application that processes user input; no authentication or special configuration is needed. Fix is available in version 0.6.0, replacing the eager str(self) materialization with a linear-time concatenation of already-cached child values.

Affected products

  • sqlparse sqlparse <= 0.5.5

Identifiers

  • CVE-2026-54284
  • GHSA-pwgv-4x5q-6m9f
  • PYSEC-2026-3699

Timeline

  • 2026-08-13: disclosed
  • 2026-08-17: advisory
  • 2026-08-17: patched: Fixed in version 0.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.