Sqlparse Project Sqlparse vulnerabilities

CVE-2024-4340 [HIGH] CWE-674 sqlparse parsing heavily nested list leads to Denial of Service sqlparse parsing heavily nested list leads to Denial of Service ### Summary Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. ### Details + PoC Running the following code will raise Maximum recursion limit exceeded exception: ```py import sqlparse sqlparse.parse('[' * 10000 + ']' * 10000) ``` We expect a traceback of RecursionError: ```py Traceback (m

CVE-2026-54284 [HIGH] CWE-1333 sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger ### Summary `sqlparse` ships hard limits (`MAX_GROUPING_DEPTH=100`, `MAX_GROUPING_TOKENS=10000`) intended to bound parsing work on attacker-supplied SQL, but the path that *reaches* those limits is itself `O(n*depth)` per token-gro

CVE-2026-71491 [HIGH] CWE-400 sqlparse: Quadratic O(n²) DoS in group_comments sqlparse: Quadratic O(n²) DoS in group_comments ### Summary A comment-only statement (`-- c\n`*n) may cause a Denial of Service (DoS). ### Details Location: [sqlparse/engine/grouping.py:331-341](https://github.com/andialbrecht/sqlparse/blob/f80af6a4007f11ada847218df8c29dc859238290/sqlparse/engine/grouping.py#L332) (`group_comments`), invoked first in `group()` at `grouping.py:439`. Reachable via `sqlparse.parse()` an

CVE-2021-32839 [HIGH] CWE-400 CVE-2021-32839: sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 ther sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL

CVE-2026-59893 [HIGH] CWE-1333 sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) ### Summary sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse/keywords.py:33` uses a backreference (`\1`) to match closing dollar-quote delimiters, causing O(n²) C

CVE-2023-30608 [HIGH] CWE-1333 CVE-2023-30608: sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser conta sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c

CVE-2026-59894 [MEDIUM] CWE-94 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes ### Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, t

CVE-2026-84305 [MEDIUM] CWE-407 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption ### Summary When SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-tok