{"id":"CVE-2026-84305","aliases":["DEBIAN-CVE-2026-84305","EUVD-2026-69421","GHSA-3496-9g83-7v6x","GHSA-cfqr-cjx5-5jcm","GHSA-f2ff-p2ww-7p4p","GHSA-prg7-hcfm-mfcr","GHSA-pwgv-4x5q-6m9f","OESA-2026-4320","PYSEC-2026-3923","RHLW-2026-7cb565d499929657","SUSE-SU-2026:23634-1","SUSE-SU-2026:3978-1","SUSE-SU-2026:4109-1","SUSE-SU-2026:4145-1","UBUNTU-CVE-2026-84305","openSUSE-SU-2026:21777-1"],"status":"published","title":"sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption","description":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00189,"percentile":0.0859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2026-09-01T18:33:10Z","modified":"2026-11-06T19:30:02Z","fixes":[{"ecosystem":"PyPI","package":"sqlparse","fixed_in":["0.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-sqlparse","fixed_in":["0.5.3-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-sqlparse","fixed_in":["0.5.3-160000.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-sqlparse","fixed_in":["0.2.4-150100.6.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-sqlparse","fixed_in":["0.4.4-150400.6.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-sqlparse","fixed_in":["0.4.4-150400.6.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-sqlparse","fixed_in":["0.4.4-150600.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-sqlparse","fixed_in":["0.4.4-150600.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-sqlparse","fixed_in":["0.5.3-160000.5.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.5.5"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-1","0.4.2-1+deb12u1","0.4.4-1","0.5.0-1","0.5.1-1","0.5.1-2","0.5.2-1","0.5.3-1","0.5.4-1","0.5.5-1","0.5.5-2"]},{"source":"osv","ecosystem":"Debian:13","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.3-1","0.5.4-1","0.5.5-1","0.5.5-2"]},{"source":"osv","ecosystem":"Debian:14","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.3-1","0.5.4-1","0.5.5-1","0.5.5-2"]},{"source":"osv","ecosystem":"PyPI","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.18","0.1.19","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.18","0.1.19","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5"]},{"source":"osv","ecosystem":"Red Hat Lightwell:PyPI","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.5+rhlw.1"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","0.1.16","0.1.17","0.1.18","0.1.19","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5"],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-160000.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.4-150100.6.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-150400.6.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-150400.6.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-150600.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.4-150600.3.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.13-2ubuntu2","0.1.18-1","0.1.18-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.2-1","0.2.4-0.1","0.2.4-0.1ubuntu0.1","0.2.4-0.1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.2.4-1","0.2.4-1build1","0.2.4-2","0.2.4-3","0.2.4-3ubuntu0.1","0.2.4-3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.1-1ubuntu1","0.4.2-1","0.4.2-1ubuntu0.22.04.1","0.4.2-1ubuntu0.22.04.2","0.4.2-1ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-1ubuntu1","0.4.4-1","0.4.4-1ubuntu0.1","0.4.4-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.4-1","0.5.5-2","0.5.5-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.3-1","0.5.4-1","0.5.4-1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-160000.5.1"}]}]}],"products":[{"vendor":"andialbrecht","product":"sqlparse"}],"references":[{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm","tags":["x_refsource_CONFIRM","exploit","advisory","web","report"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/andialbrecht/sqlparse/releases/tag/0.6.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-cfqr-cjx5-5jcm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84305.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84305","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-84305","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59894","tags":["advisory"]},{"url":"https://pypi.org/project/sqlparse","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54284.json","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54284","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-pwgv-4x5q-6m9f","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59893.json","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59893","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-prg7-hcfm-mfcr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59894.json","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3496-9g83-7v6x","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71491.json","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71491","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-f2ff-p2ww-7p4p","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623634-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278097","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84305","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263978-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264109-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264145-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-84305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84305","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-84305","title":"sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption","description":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.","status":"published","published":"2026-09-01T18:33:10.969Z","modified":"2026-09-01T19:12:52.039Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-69421","description":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.","status":"published","published":"2026-09-01T18:33:10Z","modified":"2026-09-01T19:12:52Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:16.851436Z"}],"ghsa":[{"id":"GHSA-cfqr-cjx5-5jcm","title":"sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption","description":"### Summary\n\nWhen SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-token cap. Thousands of offset calculations then traverse an expanding token tree, causing multi-second CPU consumption from an input of roughly 16 KB and degrading service availability.\n\n### Details\n\n`ReindentFilter._get_offset()` joins the tokens returned by `_flatten_up_to_token()` to calculate the current output position. Each call begins by flattening the current statement from its start and walks until the target token. Tuple-list reindentation invokes this calculation repeatedly as it processes many parenthesized values, so later calls redo an increasingly large amount of prior work.\n\nThe vulnerable path is reached through `sqlparse.format(sql, reindent=True)` and `sqlformat --reindent`. A carefully sized tuple list completes grouping below the configured token cap and then enters the expensive reindentation path; a slightly larger input may instead be rejected quickly by the cap.\n\nRelevant code locations:\n\n- `sqlparse/formatter.py:170` — enabling `ReindentFilter`\n- `sqlparse/filters/reindent.py:30` — repeated flattening from the statement start\n- `sqlparse/filters/reindent.py:44` — prefix joining for offset calculation\n- `sqlparse/filters/reindent.py:216` — tuple-list processing path\n\n### PoC\n\nA complete validated reproduction is attached as [reindent_tuple_list_cpu_dos-poc.zip](https://github.com/user-attachments/files/29410152/reindent_tuple_list_cpu_dos-poc.zip). The archive contains `reproduction/` at its root, uses Git and Docker, and compares two same-shape tuple-list inputs formatted with reindentation enabled.\n\nExtract the archive beside this report, then run:\n\n```console\n./reproduction/run.sh\n```\n\nObserved result:\n\nThe 600-tuple baseline completed in 0.649 seconds, while the below-cap 1,425-tuple input completed in 4.999 seconds. The run emitted `EVOHUNT_REINDENT_DOS_VERIFIED` and completed successfully.\n\nVerification method:\n\nThe verification helper formats two same-shape tuple-list payloads with `reindent=True` and fails unless the larger payload completes successfully, takes at least 2.0 seconds, and takes at least 4x the baseline.\n\nLimitations:\n\nNo reproduction blocker was recorded. Timing varies by host, and exploitation requires the reindentation option or corresponding CLI mode to be enabled.\n\n### Impact\n\nThis is a CPU resource-exhaustion vulnerability in workflows that reindent attacker-controlled SQL. A small crafted tuple-list input can occupy a worker for several seconds, enabling request delays, reduced throughput, or worker starvation when payloads are processed repeatedly or concurrently.\n\nThe affected reindentation behavior is opt-in, and sqlparse itself does not provide network exposure; reachability depends on the consuming application or CLI workflow. The demonstrated effect is CPU consumption in a single formatting call, not process termination, code execution, or confidentiality or integrity impact.","status":"published","published":"2026-09-01T21:20:11Z","modified":"2026-09-01T21:21:22Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:41:10.121131Z"}],"nvd":[{"id":"CVE-2026-84305","description":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.","status":"published","published":"2026-09-01T19:17:30.887Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:12:43.04945Z"}],"osv":[{"id":"CVE-2026-84305","title":"sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption","description":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.","status":"published","published":"2026-09-01T18:33:10.969Z","modified":"2026-10-28T02:30:22.672542761Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-84305","description":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.","status":"published","published":"2026-09-01T19:17:30.887Z","modified":"2026-10-01T03:03:44.075897711Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:04.577397Z"},{"id":"GHSA-cfqr-cjx5-5jcm","title":"sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption","description":"### Summary\n\nWhen SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-token cap. Thousands of offset calculations then traverse an expanding token tree, causing multi-second CPU consumption from an input of roughly 16 KB and degrading service availability.\n\n### Details\n\n`ReindentFilter._get_offset()` joins the tokens returned by `_flatten_up_to_token()` to calculate the current output position. Each call begins by flattening the current statement from its start and walks until the target token. Tuple-list reindentation invokes this calculation repeatedly as it processes many parenthesized values, so later calls redo an increasingly large amount of prior work.\n\nThe vulnerable path is reached through `sqlparse.format(sql, reindent=True)` and `sqlformat --reindent`. A carefully sized tuple list completes grouping below the configured token cap and then enters the expensive reindentation path; a slightly larger input may instead be rejected quickly by the cap.\n\nRelevant code locations:\n\n- `sqlparse/formatter.py:170` — enabling `ReindentFilter`\n- `sqlparse/filters/reindent.py:30` — repeated flattening from the statement start\n- `sqlparse/filters/reindent.py:44` — prefix joining for offset calculation\n- `sqlparse/filters/reindent.py:216` — tuple-list processing path\n\n### PoC\n\nA complete validated reproduction is attached as [reindent_tuple_list_cpu_dos-poc.zip](https://github.com/user-attachments/files/29410152/reindent_tuple_list_cpu_dos-poc.zip). The archive contains `reproduction/` at its root, uses Git and Docker, and compares two same-shape tuple-list inputs formatted with reindentation enabled.\n\nExtract the archive beside this report, then run:\n\n```console\n./reproduction/run.sh\n```\n\nObserved result:\n\nThe 600-tuple baseline completed in 0.649 seconds, while the below-cap 1,425-tuple input completed in 4.999 seconds. The run emitted `EVOHUNT_REINDENT_DOS_VERIFIED` and completed successfully.\n\nVerification method:\n\nThe verification helper formats two same-shape tuple-list payloads with `reindent=True` and fails unless the larger payload completes successfully, takes at least 2.0 seconds, and takes at least 4x the baseline.\n\nLimitations:\n\nNo reproduction blocker was recorded. Timing varies by host, and exploitation requires the reindentation option or corresponding CLI mode to be enabled.\n\n### Impact\n\nThis is a CPU resource-exhaustion vulnerability in workflows that reindent attacker-controlled SQL. A small crafted tuple-list input can occupy a worker for several seconds, enabling request delays, reduced throughput, or worker starvation when payloads are processed repeatedly or concurrently.\n\nThe affected reindentation behavior is opt-in, and sqlparse itself does not provide network exposure; reachability depends on the consuming application or CLI workflow. The demonstrated effect is CPU consumption in a single formatting call, not process termination, code execution, or confidentiality or integrity impact.","status":"published","published":"2026-09-01T21:20:11Z","modified":"2026-09-10T12:25:55.468982803Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"OESA-2026-4320","title":"python-sqlparse security update","description":"A non-validating SQL parser.\r\n\r\nSecurity Fix(es):\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format=\u0026apos;python\u0026apos; and output_format=\u0026apos;php\u0026apos; and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.(CVE-2026-59894)\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.(CVE-2026-84305)","status":"published","published":"2026-10-16T11:59:19Z","modified":"2026-10-16T12:15:09.077348048Z","cvss":[{"version":"4.0","score":6.2,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"PYSEC-2026-3923","title":"sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption","description":"### Summary\n\nWhen SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-token cap. Thousands of offset calculations then traverse an expanding token tree, causing multi-second CPU consumption from an input of roughly 16 KB and degrading service availability.\n\n### Details\n\n`ReindentFilter._get_offset()` joins the tokens returned by `_flatten_up_to_token()` to calculate the current output position. Each call begins by flattening the current statement from its start and walks until the target token. Tuple-list reindentation invokes this calculation repeatedly as it processes many parenthesized values, so later calls redo an increasingly large amount of prior work.\n\nThe vulnerable path is reached through `sqlparse.format(sql, reindent=True)` and `sqlformat --reindent`. A carefully sized tuple list completes grouping below the configured token cap and then enters the expensive reindentation path; a slightly larger input may instead be rejected quickly by the cap.\n\nRelevant code locations:\n\n- `sqlparse/formatter.py:170` — enabling `ReindentFilter`\n- `sqlparse/filters/reindent.py:30` — repeated flattening from the statement start\n- `sqlparse/filters/reindent.py:44` — prefix joining for offset calculation\n- `sqlparse/filters/reindent.py:216` — tuple-list processing path\n\n### PoC\n\nA complete validated reproduction is attached as [reindent_tuple_list_cpu_dos-poc.zip](https://github.com/user-attachments/files/29410152/reindent_tuple_list_cpu_dos-poc.zip). The archive contains `reproduction/` at its root, uses Git and Docker, and compares two same-shape tuple-list inputs formatted with reindentation enabled.\n\nExtract the archive beside this report, then run:\n\n```console\n./reproduction/run.sh\n```\n\nObserved result:\n\nThe 600-tuple baseline completed in 0.649 seconds, while the below-cap 1,425-tuple input completed in 4.999 seconds. The run emitted `EVOHUNT_REINDENT_DOS_VERIFIED` and completed successfully.\n\nVerification method:\n\nThe verification helper formats two same-shape tuple-list payloads with `reindent=True` and fails unless the larger payload completes successfully, takes at least 2.0 seconds, and takes at least 4x the baseline.\n\nLimitations:\n\nNo reproduction blocker was recorded. Timing varies by host, and exploitation requires the reindentation option or corresponding CLI mode to be enabled.\n\n### Impact\n\nThis is a CPU resource-exhaustion vulnerability in workflows that reindent attacker-controlled SQL. A small crafted tuple-list input can occupy a worker for several seconds, enabling request delays, reduced throughput, or worker starvation when payloads are processed repeatedly or concurrently.\n\nThe affected reindentation behavior is opt-in, and sqlparse itself does not provide network exposure; reachability depends on the consuming application or CLI workflow. The demonstrated effect is CPU consumption in a single formatting call, not process termination, code execution, or confidentiality or integrity impact.","status":"published","published":"2026-09-10T09:44:59.09768Z","modified":"2026-09-10T12:15:12.861384023Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.255153Z"},{"id":"RHLW-2026-7cb565d499929657","title":"Lightwell Security Advisory: sqlparse 0.5.5+rhlw.1","description":"Red Hat Lightwell has released sqlparse 0.5.5+rhlw.1 with backported fixes for CVE-2026-54284, CVE-2026-59893, CVE-2026-59894, CVE-2026-71491, and CVE-2026-84305.\n\nCVE-2026-54284: sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger\n\nCVE-2026-59893: sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)\n\nCVE-2026-59894: sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes\n\nCVE-2026-71491: sqlparse: Quadratic O(n²) DoS in group_comments\n\nCVE-2026-84305: sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption\n\nThis patched artifact is a drop-in replacement for sqlparse 0.5.5 from PyPI.","status":"published","published":"2026-10-13T20:35:24Z","modified":"2026-11-06T19:43:12.440732746Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T20:08:20.701853Z"},{"id":"UBUNTU-CVE-2026-84305","description":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.","status":"published","published":"2026-09-01T19:17:00Z","modified":"2026-10-17T13:01:12.462103282Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:22.213888Z"},{"id":"openSUSE-SU-2026:21777-1","title":"Security update for python-sqlparse","description":"This update for python-sqlparse fixes the following issue:\n\n- CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097).\n","status":"published","published":"2026-09-06T16:46:15Z","modified":"2026-09-09T18:23:15.275035576Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23634-1","title":"Security update for python-sqlparse","description":"This update for python-sqlparse fixes the following issue:\n\n- CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097).\n","status":"published","published":"2026-09-06T16:45:50Z","modified":"2026-09-29T18:23:10.290301418Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3978-1","title":"Security update for python-sqlparse","description":"This update for python-sqlparse fixes the following issue:\n\n- CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097).\n","status":"published","published":"2026-09-04T09:19:34Z","modified":"2026-09-13T18:23:13.349852412Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4109-1","title":"Security update for python-sqlparse","description":"This update for python-sqlparse fixes the following issue:\n\n- CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097).\n","status":"published","published":"2026-09-09T13:26:02Z","modified":"2026-09-14T18:23:17.584065066Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4145-1","title":"Security update for python-sqlparse","description":"This update for python-sqlparse fixes the following issue:\n\n- CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097).\n","status":"published","published":"2026-09-14T08:00:22Z","modified":"2026-09-15T17:00:04.815398361Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}