AIKIDO-2026-299858
sqlparse is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
sqlparseTL;DR
Comment grouping in sqlparse runs before the token-count guard and rescans the remaining tokens for every comment token. A statement composed of many single-line comments never groups, so the repeated scans produce a heavy workload on parsing and comment-stripping formatting. A comment-only payload can occupy a CPU core for minutes regardless of the grouping token cap. The fix advances comment grouping without repeatedly rescanning the full token list.
Who does this affect?
You are affected if you use a version in the vulnerable range and pass untrusted SQL to sqlparse.parse or run sqlparse.format(sql, strip_comments=True) on externally influence input
Background info
sqlparse is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 0.5.5.
How to fix this
Upgrade the sqlparse library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant