CVE-2026-54284
Received Received - Intake

Denial of Service in sqlparse via Quadratic CPU Consumption

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-54284
EUVD
EUVD-2026-60313

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
andialbrecht sqlparse to 0.6.0 (exc)
andialbrecht sqlparse to 0.5.5 (exc)
sqlparse sqlparse to 0.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54284 is a high-severity vulnerability in the sqlparse library affecting versions before 0.6.0. It causes CPU-based denial-of-service (DoS) attacks due to inefficient algorithmic complexity in TokenList construction and string conversion. The issue involves repeatedly flattening nested token subtrees during operations like sqlparse.parse(), sqlparse.format(), and sqlparse.split(), leading to quadratic CPU consumption before depth and token limits are triggered.

Detection Guidance

Check if your system uses sqlparse version 0.5.5 or earlier by running: pip show sqlparse. If installed, verify if any applications call sqlparse.parse(), sqlparse.format(), or sqlparse.split() with deeply nested SQL inputs.

Impact Analysis

This vulnerability can cause severe performance degradation or complete denial of service in applications using affected sqlparse versions. A malicious 2 KB SQL payload could consume up to 10 seconds of CPU time per request, potentially locking single-threaded services for seconds or exhausting worker pools in multi-worker setups. Services processing deeply nested SQL structures are particularly vulnerable.

Compliance Impact

This vulnerability causes CPU-based denial-of-service (DoS) attacks due to inefficient algorithmic complexity, leading to severe performance degradation. While not directly violating GDPR or HIPAA, such DoS conditions could disrupt availability of systems handling personal or health data, potentially violating compliance requirements for timely access and system reliability.

Mitigation Strategies

Upgrade sqlparse to version 0.6.0 or later using: pip install --upgrade sqlparse. Review applications using sqlparse to ensure they handle nested SQL inputs safely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54284. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart