GHSA-27jp-wm6q-gp25
sqlparse: formatting list of tuples leads to denial of service
Summary
The below gist hangs while attempting to format a long list of tuples.
This was found while drafting a regression test for Dja ngo 5.2's composite primary key feature, which allows querying composite fields with tuples.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
sqlparse: formatting list of tuples leads to denial of service
Summary
The below gist hangs while attempting to format a long list of tuples.
This was found while drafting a regression test for Dja ngo 5.2's composite primary key feature, which allows querying composite fields with tuples.
- Record
GHSA-27jp-wm6q-gp25- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
sqlparse: formatting list of tuples leads to denial of service
Summary
The below gist hangs while attempting to format a long list of tuples.
This was found while drafting a regression test for Dja ngo 5.2's composite primary key feature, which allows querying composite fields with tuples.
- Record
GHSA-27jp-wm6q-gp25- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVROOT-APP-PYPI-GHSA-27jp-wm6q-gp25No score
GHSA-27jp-wm6q-gp25 in sqlparse - Patched by Root
Root has patched GHSA-27jp-wm6q-gp25 in the sqlparse package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-GHSA-27jp-wm6q-gp25- Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sqlparsePyPI | through 0.5.3 | 0.5.4 |
sqlparsePyPI | before 0.5.4, plus listed versions 0.1.00.1.10.1.100.1.110.1.12 Show 31 moreShow less0.1.130.1.140.1.150.1.160.1.170.1.180.1.190.1.20.1.30.1.40.1.50.1.60.1.70.1.80.1.90.2.00.2.10.2.20.2.30.2.40.3.00.3.10.4.00.4.10.4.20.4.30.4.40.5.00.5.10.5.20.5.3 | 0.5.4 |
sqlparseRoot:PyPI | before 0.4.4+aikido.1 | 0.4.4+aikido.10.5.3+aikido.10.3.0+aikido.20.3.0+aikido.30.3.0+aikido.40.5.3+aikido.20.3.0+aikido.50.3.0+aikido.60.5.1+aikido.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-27jp-wm6q-gp25 is a medium vulnerability (CVSS 6.9) in sqlparse, published February 13, 2026. No source lists public exploit code. Fixed in sqlparse 0.5.4.