CVE-2026-84305: sqlparse quadratic CPU consumption in reindent filter

CVE-2026-84305 · Severity: medium · CVSS 4 · Published 2026-09-01

sqlparse is a Python library that parses and formats SQL statements. When the optional SQL reindentation feature is enabled, an attacker can craft a specially-sized SQL statement with nested tuples that causes the formatter to consume multiple seconds of CPU per request, potentially stalling worker processes and degrading service availability through resource exhaustion.

Technologies: sqlparse (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-84305 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84305 being exploited in the wild.
How severe is CVE-2026-84305?
Medium severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?
sqlparse (PyPI) <= 0.5.5, ECOSYSTEM:introduced=0,fixed=0.6.0.
Is there a fix for CVE-2026-84305?
Yes. sqlparse (PyPI): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84305 attacked?
It is attacked with local access.
Am I affected by CVE-2026-84305?
Check whether you run sqlparse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sqlparse (PyPI): upgrade to 0.6.0 or later
    pip install "sqlparse>=0.6.0"

Technical details

The vulnerability is an algorithmic complexity flaw (CWE-407) in the `ReindentFilter` class. When reindentation is enabled via `sqlparse.format(sql, reindent=True)` or the `--reindent` CLI flag, the `_get_offset()` method repeatedly reconstructs token trees from the statement start to calculate output positions. Processing a parenthesized tuple list that remains just below the grouping-token cap triggers quadratic behavior: later offset calculations redundantly traverse increasingly large portions of the token tree. An attacker who controls SQL input can supply a ~16 KB payload with ~1425 tuples to cause multi-second delays (demonstrated as 4+ seconds vs. 0.6 seconds baseline). The attack requires the reindentation option to be explicitly enabled; sqlparse itself does not expose network interfaces. Impact is CPU starvation and request delays; no code execution, data exposure, or integrity compromise occurs. Patch available in version 0.6.0.

Affected products

  • andialbrecht sqlparse <= 0.5.5

Identifiers

  • CVE-2026-84305
  • GHSA-cfqr-cjx5-5jcm
  • PYSEC-2026-3923

Timeline

  • 2026-09-01: disclosed: Published to GitHub Advisory Database
  • 2026-09-01: patched: Fixed in sqlparse 0.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.