sqlparse is a non‑validating SQL parser for Python. In versions prior to 0.6.0, the regular expression used to detect dollar‑quoted SQL literals together with a per‑position loop in the lexer repeatedly scans unmatched delimiters, causing quadratic CPU consumption when calling parse(), format(), or split(). The result is a ReDoS denial of service that can exhaust server resources, leading to service disruption. This flaw does not compromise confidentiality or integrity, but it threatens availability of Python applications that rely on sqlparse.

The vulnerability affects the Python library sqlparse provided by the project and author andialbrecht. All releases before version 0.6.0 are impacted, including those used in scripts, frameworks, or databases that incorporate sqlparse for SQL handling.

The CVSS score of 7.5 indicates a medium‑to‑high severity. While the EPSS score is not available, the lack of listing in CISA KEV suggests that exploitation is not widely observed yet. The flaw is a regex‑based denial of service that requires an attacker to supply a malicious SQL string that triggers the quadratic scan. Based on the description, it is inferred that any API that calls parse(), format(), or split() with untrusted input can be abused to exhaust CPU resources, potentially impacting availability of the host application.