AIKIDO-2026-309661
sqlparse is vulnerable to Denial of Service (DoS)
51
Medium Risk
This Affects:
sqlparseTL;DR
The reindentation formatter in sqlparse recalculates token offsets by repeatedly flattening and joining the current statement from its start. When SQL with a large parenthesized tuple list is formatted with reindentation enabled, these offset calculations traverse an expanding token tree. A crafted tuple list sized just below the grouping-token cap can consume several seconds of CPU. The fix computes offsets without redoing the growing prefix work on every processed token.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you format untrusted SQL with reindentation enabled.
Background info
sqlparse is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 0.5.5.
How to fix this
Upgrade the sqlparse library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant