Andialbrecht
Monthly
Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.
Quadratic CPU consumption in sqlparse's group_comments function (grouping.py) allows remote unauthenticated denial of service against any Python application that passes attacker-controlled input to sqlparse.parse() or sqlparse.format(sql, strip_comments=True). A comment-only payload of roughly 250 KB forces minutes of CPU burn regardless of the MAX_GROUPING_TOKENS guard, because group_comments executes before that cap is checked. A public proof-of-concept with benchmark data confirms O(n²) scaling: n=4000 comments takes ~1600 ms versus ~106 ms at n=1000; no public exploit identified at time of analysis beyond the researcher's PoC, and the vulnerability is not listed in CISA KEV.
Quadratic CPU exhaustion in sqlparse's reindentation path allows denial of service against any Python application that passes attacker-controlled SQL to sqlparse.format() with reindent=True. The ReindentFilter._get_offset() method formerly rebuilt the full statement prefix from the token tree's root on every call, resulting in O(N²) CPU growth when processing parenthesized tuple lists - such as large IN (...) or INSERT INTO ... VALUES (...) expressions. A ~12 KB crafted SQL payload can pin a CPU worker for seconds, enabling request delays, throughput reduction, or worker starvation in any service that exposes this formatting path. No public exploit has been identified at time of analysis, and the fix is available in sqlparse 0.6.0.
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.
Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.
Quadratic CPU consumption in sqlparse's group_comments function (grouping.py) allows remote unauthenticated denial of service against any Python application that passes attacker-controlled input to sqlparse.parse() or sqlparse.format(sql, strip_comments=True). A comment-only payload of roughly 250 KB forces minutes of CPU burn regardless of the MAX_GROUPING_TOKENS guard, because group_comments executes before that cap is checked. A public proof-of-concept with benchmark data confirms O(n²) scaling: n=4000 comments takes ~1600 ms versus ~106 ms at n=1000; no public exploit identified at time of analysis beyond the researcher's PoC, and the vulnerability is not listed in CISA KEV.
Quadratic CPU exhaustion in sqlparse's reindentation path allows denial of service against any Python application that passes attacker-controlled SQL to sqlparse.format() with reindent=True. The ReindentFilter._get_offset() method formerly rebuilt the full statement prefix from the token tree's root on every call, resulting in O(N²) CPU growth when processing parenthesized tuple lists - such as large IN (...) or INSERT INTO ... VALUES (...) expressions. A ~12 KB crafted SQL payload can pin a CPU worker for seconds, enabling request delays, throughput reduction, or worker starvation in any service that exposes this formatting path. No public exploit has been identified at time of analysis, and the fix is available in sqlparse 0.6.0.
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.