AIKIDO-2026-568664
sqlparse is vulnerable to Regular Expression Denial of Service (ReDoS)
75
High Risk
This Affects:
sqlparseTL;DR
The sqlparse lexer matches PostgreSQL dollar-quoted literals with a regular expression that uses a backreference to find the closing delimiter, and applies it at every input position. SQL containing many unique, unterminated dollar-quote openers forces the engine to rescan the remaining input for each opener. The same lazy dot-all shape also affects the multiline-comment patterns. Any application passing untrusted SQL to parse, format, or split can trigger sustained CPU exhaustion without authentication. The fix resolves delimiter pairs deterministically instead of relying on backtracking.
Who does this affect?
You are affected if you use a version in the vulnerable range and pass untrusted or externally influenced SQL to sqlparse.parse, sqlparse.format, or sqlparse.split.
Background info
sqlparse is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.0.1 - 0.5.5.
How to fix this
Upgrade the sqlparse library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant