sqlparse is a non-validating SQL parser for Python. Prior to version 0.6.0, the construction and string conversion of TokenList objects in sqlparse/sql.py flattened nested token subtrees generated by group_parenthesis and group_case. This flattening process is performed repeatedly during parse(), format(), and split() calls, producing a quadratic growth in CPU usage. An attacker can supply a specially crafted SQL statement that triggers this behavior, exhausting CPU resources and causing a denial of service before the parser’s depth or token limits are reached.

The vulnerability affects the andialbrecht:sqlparse package for Python. Any installation of sqlparse with a version earlier than 0.6.0 is susceptible. The issue is fixed in version 0.6.0 and later; updating to 0.6.0 or a newer release removes the flaw.

The CVSS score of 8.7 indicates a high severity of the flaw. Because the problem manifests during normal parser usage, an attacker with ability to supply input to sqlparse—such as a web application that parses user-supplied SQL—can trigger it. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is by providing malicious SQL to any function that calls sqlparse.parse(), sqlparse.format(), or sqlparse.split().