Executive brief
sqlparse is a popular Python library for parsing and formatting SQL queries. The library contains a flaw that causes it to hang (stop responding) when attempting to format SQL queries containing long lists of tuples, such as those used in Django's composite primary key queries. An attacker or malicious application could exploit this to cause a denial of service by submitting specially crafted SQL queries.
Technical details
A denial-of-service vulnerability exists in sqlparse's tuple formatting logic due to inefficient recursion or iteration when processing large parenthesized tuple lists (CWE-770: Allocation of Resources Without Limits or Throttling). The vulnerability is triggered when the library attempts to format SQL containing multiple nested or sequential tuples, such as "IN ((1,1), (1,2), ..., (1,N))" with many entries. The attack vector is network-based if sqlparse is used in a web application or API to format user-supplied SQL. No authentication is required. An attacker can cause the process to hang indefinitely, consuming CPU resources and preventing legitimate requests from being processed. The vulnerability was patched in version 0.5.4 by adding hard limits for grouping operations to prevent resource exhaustion.
Affected products
- sqlparse sqlparse <=0.5.3
Timeline
- 2026-02-13: disclosed
- 2026-02-13: patched: Fixed in version 0.5.4