CVE-2026-84305
Received Received - Intake

Denial of Service in sqlparse via ReindentFilter

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84305
EUVD
EUVD-2026-69421

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sqlparse sqlparse to 0.6.0 (inc)
andialbrecht sqlparse to 0.6.0 (exc)
andialbrecht sqlparse 0.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service vulnerability in the sqlparse Python library before version 0.6.0. It occurs when processing SQL statements with parenthesized tuple lists using the reindent feature. The parser inefficiently recalculates offsets for tokens, causing quadratic CPU usage growth as input size increases.

Detection Guidance

This vulnerability can be detected by checking the installed version of sqlparse. Run 'pip show sqlparse' or 'pip list | grep sqlparse' to verify if the version is below 0.6.0. If so, the system is vulnerable.

Impact Analysis

An attacker could exploit this by sending specially crafted SQL queries to a service using the vulnerable sqlparse library. This would consume excessive CPU resources, leading to slow response times, reduced system throughput, or complete service unavailability due to worker starvation.

Compliance Impact

This vulnerability causes CPU resource exhaustion through quadratic time complexity in SQL formatting, leading to service degradation or unavailability. For GDPR, this could impact availability of data processing systems, potentially violating Article 32 requirements for resilience. For HIPAA, degraded performance in systems handling protected health information could affect access controls and audit logging.

Mitigation Strategies

Upgrade sqlparse to version 0.6.0 or later using 'pip install --upgrade sqlparse'. If upgrading is not possible, avoid using sqlparse.format(sql, reindent=True) or the sqlformat command with --reindent flag on untrusted input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84305. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart