The vulnerability lies in sqlparse’s grouping logic. Prior to version 0.6.0 the function that handles comment grouping repeatedly rescanned comment‑only statements before the MAX_GROUPING_TOKENS guard, resulting in quadratic CPU consumption when parsing or formatting SQL containing comments. An attacker can exploit this by submitting crafted SQL that causes the parser to perform excessive work, exhausting CPU resources and effectively denying service. The weakness matches CWE‑400 (Uncontrolled Resource Consumption) and CWE‑407 (Improper Access Control).

The affected product is the Python library sqlparse from the vendor andialbrecht. Any installation of sqlparse with an older release – 0.5.x or earlier – is vulnerable. Code that employs sqlparse.parse() or sqlparse.format(sql, strip_comments=True) on untrusted input may trigger the issue.

The CVSS score of 8.7 indicates high severity, while the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, making public exploitation risk uncertain. The attack vector is essentially any pathway that allows an attacker to supply SQL text to the library, such as a web application or a background job that processes user data. Once triggered, the flaw does not leak data or modify state, but it can consume disproportionate CPU capacity, potentially leading to application slowdown or outage. The high score and lack of mitigation controls suggest urgent attention.