Executive brief
sqlparse is a SQL parser library used by many Python applications to parse and format SQL queries. A flaw in its regex pattern matching allows attackers to submit specially crafted SQL text with many unmatched dollar-quote delimiters, causing the parser to consume excessive CPU resources in a quadratic time pattern. Applications that accept user-supplied SQL—such as web interfaces, database tools, or query formatters—can be forced to hang or become unresponsive, disrupting service for legitimate users without requiring authentication.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the dollar-quoted SQL literal pattern at sqlparse/keywords.py:33. The regex uses a backreference (`\1`) to match closing delimiters: `(r'((?<![\w\"\$])\$(?:[_A-ZÀ-Ü]\w*)?\$)[\s\S]*?\1', tokens.Literal)`. When processing SQL with many unique, unmatched opening dollar-quote sequences (e.g., `$a0$x $a1$x $a2$x ...`), the regex engine exhausts the remaining input at each position before backtracking, resulting in O(n²) time complexity. The same issue affects multiline comment patterns (`/*` and `/*+`). The lexer applies all regex patterns at every input character position without timeout or length limits, making the flaw exploitable via any public API (`sqlparse.parse()`, `sqlparse.format()`, `sqlparse.split()`) that accepts user-controlled SQL. Empirical testing confirms 3.3× slowdown when input doubles (n=1000 → n=2000, 0.397s → 1.314s). A patch replacing the backreference approach with deterministic O(n) delimiter matching is available in version 0.6.0.
Affected products
- andialbrecht sqlparse <= 0.5.6.dev0
Timeline
- 2026-08-13: disclosed: GitHub Security Advisory published
- 2026-08-17: patched: Fix released in sqlparse 0.6.0