Description

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T18:17:35.730Z",
  "pubdate": "2026-08-17T18:17:35.730Z",
  "executiveSummary": "A Denial of Service (DoS) vulnerability exists in the sqlparse Python module prior to version 0.6.0. The vulnerability is classified as a Regular Expression Denial of Service (ReDoS) and algorithmic complexity flaw, leading to excessive and quadratic CPU consumption.\nThe issue affects systems utilizing the sqlparse library to process SQL strings via functions such as sqlparse.parse(), sqlparse.format(), and sqlparse.split(). By supplying specially crafted input containing unmatched dollar-quoted literals or multiline-comment delimiters, an unauthenticated attacker can exhaust computational resources, causing application hangs or complete service unavailability.\nThe risk implication is high for services that expose parsing functionalities directly to untrusted user input without strict validation or rate limiting. Exploitation requires no prior authentication or special privileges, relying solely on the submission of malicious SQL payloads to trigger the intensive parsing loops.",
  "technicalDetails": "The root cause of the vulnerability stems from inefficient pattern matching and iterative scanning logic within the library's lexical analysis components. Specifically, SQL_REGEX located in sqlparse/keywords.py and the per-position scanning loop located in sqlparse/lexer.py repeatedly evaluate unmatched dollar-quoted literal and multiline-comment delimiters.\nBecause the underlying scanning mechanism fails to efficiently handle unmatched or malformed delimiter structures, the computational complexity scales quadratically ($O(n^2)$) relative to the length of the input string or the frequency of the targeted delimiters.\nThe vulnerable components comprise the lexical analysis and parsing engine invoked through standard interface functions including sqlparse.parse(), sqlparse.format(), and sqlparse.split(). All versions of sqlparse prior to 0.6.0 are affected by this parsing inefficiency.\nThe attack flow proceeds as follows: an attacker crafts an HTTP request or input vector containing a long string of unclosed dollar-quoted literals or multiline comments. This payload is submitted to an application endpoint that passes the data directly to the vulnerable sqlparse processing functions. Upon ingestion, the lexer enters the per-position loop and repeatedly scans the unmatched delimiters across the input string. This repetitive scanning pattern causes CPU utilization to spike to 100% on the processing core, exhausting available thread pools or application worker processes.\nNo authentication or elevated privileges are required to initiate this attack, provided the target application accepts and processes arbitrary SQL strings using the affected library functions. The post-exploitation impact is strictly limited to availability degradation or complete Denial of Service (DoS) through resource exhaustion, rather than arbitrary code execution or data exfiltration."
}