CVE-2026-84305— sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Quick assessment
Affected
andialbrecht sqlparse
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
sqlparse 是一个用于 Python 的非验证型 SQL 解析器模块。在 0.6.0 版本之前，调用 或使用 时，攻击者控制的带括号的元组列表会经过 中 函数处理。其中， 会反复重建并拼接语句前缀。大量的偏移量计算会遍历不断扩展的令牌树，导致对未超过 的输入产生二次方级的 CPU 消耗，从而引发请求延迟、吞吐量下降或工作进程饥饿。该问题已在版本 0.6.0 中修复。
Possible ATT&CK Techniques 2 AI
T1011 · Exfiltration Over Other Network Medium T1027 · Obfuscated Files or Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84305
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Source: CVE Program / CVE List V5
Vulnerability Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| andialbrecht | sqlparse | < 0.6.0 | - |
|
II. Public POCs for CVE-2026-84305
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84305
请登录查看更多情报信息。
Other References for CVE-2026-84305 (3)
-
🔗 Release 0.6.0 · andialbrecht/sqlparse · GitHub x_refsource_MISC
-
-
IV. Related Vulnerabilities
Same product: sqlparse
-
CVE-2026-54284
sqlparse: TokenList.__init__ materializes O(subtree) value p -
CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Li -
CVE-2026-71491
sqlparse: Quadratic O(n²) DoS in group_comments -
CVE-2026-59894
sqlparse: Generated Python and PHP snippets allow SQL string -
CVE-2023-30608
Parser contains an inefficient regular expression in sqlpars
Same vendor: andialbrecht
-
CVE-2026-54284
sqlparse: TokenList.__init__ materializes O(subtree) value p -
CVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Li -
CVE-2026-71491
sqlparse: Quadratic O(n²) DoS in group_comments -
CVE-2026-59894
sqlparse: Generated Python and PHP snippets allow SQL string -
CVE-2023-30608
Parser contains an inefficient regular expression in sqlpars
Same weakness: CWE-407
-
CVE-2026-49329
Openshift/oauth-server: openshift/oauth-server: quadratic-ti -
CVE-2026-83613
xmldom: Quadratic-time attribute deduplication -
CVE-2026-82398
pypdf: Inefficient handling of non-whitespace inputs in read -
CVE-2026-77831
Algorithmic-complexity denial of service in AshPaperTrail fu -
CVE-2026-81722
nltk PorterStemmer before 3.10.3 Quadratic-time DoS
V. Comments for CVE-2026-84305
No comments yet