Executive brief
sqlparse is a Python library that parses and formats SQL statements. When the optional SQL reindentation feature is enabled, an attacker can craft a specially-sized SQL statement with nested tuples that causes the formatter to consume multiple seconds of CPU per request, potentially stalling worker processes and degrading service availability through resource exhaustion.
Technical details
The vulnerability is an algorithmic complexity flaw (CWE-407) in the `ReindentFilter` class. When reindentation is enabled via `sqlparse.format(sql, reindent=True)` or the `--reindent` CLI flag, the `_get_offset()` method repeatedly reconstructs token trees from the statement start to calculate output positions. Processing a parenthesized tuple list that remains just below the grouping-token cap triggers quadratic behavior: later offset calculations redundantly traverse increasingly large portions of the token tree. An attacker who controls SQL input can supply a ~16 KB payload with ~1425 tuples to cause multi-second delays (demonstrated as 4+ seconds vs. 0.6 seconds baseline). The attack requires the reindentation option to be explicitly enabled; sqlparse itself does not expose network interfaces. Impact is CPU starvation and request delays; no code execution, data exposure, or integrity compromise occurs. Patch available in version 0.6.0.
Affected products
- andialbrecht sqlparse <= 0.5.5
Timeline
- 2026-09-01: disclosed: Published to GitHub Advisory Database
- 2026-09-01: patched: Fixed in sqlparse 0.6.0