Skip to content

Instantly share code, notes, and snippets.

@alon710

alon710/GHSA-27JP-WM6Q-GP25.md

Created February 13, 2026 17:10
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save alon710/d702c49f6f179b4f796ceb61d6d9c9f2 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save alon710/d702c49f6f179b4f796ceb61d6d9c9f2 to your computer and use it in GitHub Desktop.
Download ZIP
GHSA-27JP-WM6Q-GP25: Death by Parentheses: The sqlparse Recursive DoS - CVE Security Report
Raw
GHSA-27JP-WM6Q-GP25.md

GHSA-27JP-WM6Q-GP25: Death by Parentheses: The sqlparse Recursive DoS

CVSS Score: 6.5 Published: 2026-02-13 Full Report: https://cvereports.com/reports/GHSA-27JP-WM6Q-GP25

Summary

A high-impact Denial of Service vulnerability in the ubiquitous sqlparse Python library allows attackers to exhaust server CPU and memory via deeply nested SQL statements. By exploiting unchecked recursion in the grouping engine, a crafted payload containing massive lists of tuples can crash applications using this library for logging, formatting, or analysis.

TL;DR

The sqlparse library prior to version 0.5.4 contains a recursive looping flaw. Attackers can trigger a Denial of Service by sending SQL queries with massive lists of tuples (e.g., in IN clauses), causing the parser to hit recursion limits or hang the CPU. Patch by upgrading to 0.5.4, which introduces circuit breakers.

Exploit Status: POC

Technical Details

  • Vulnerability Type: Denial of Service (DoS)
  • CWE ID: CWE-400 / CWE-674
  • CVSS (Estimated): 6.5 (Medium)
  • Attack Vector: Network (via crafted SQL input)
  • Affected Component: sqlparse.engine.grouping
  • Exploit Status: PoC Available

Affected Systems

  • Django Debug Toolbar
  • dbt (data build tool)
  • pgcli
  • Python-based SQL logging middleware
  • Custom SQL administration interfaces
  • sqlparse: < 0.5.4 (Fixed in: 0.5.4)

Mitigation

  • Limit complexity of SQL processed by formatting tools.
  • Implement circuit breakers for recursion depth.
  • Sanitize input length before parsing.

Remediation Steps:

  1. Identify all Python environments using sqlparse (check pip freeze).
  2. Upgrade sqlparse to version 0.5.4 or higher via pip install --upgrade sqlparse.
  3. Verify the upgrade by running pip show sqlparse.
  4. Restart application services to load the new library version.

References

Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment