sqlparse is a non‑validating Python SQL parser. Prior to version 0.6.0, its format function with the reindent argument or the sqlformat command would route attacker‑controlled parenthesized tuple lists through ReindentFilter._get_offset(). The ReindentFilter repeatedly rebuilds and joins the statement prefix, producing a near‑cubic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS. This excessive CPU usage can lead to request delays, reduced throughput, or worker starvation, effectively delivering a denial‑of‑service to services that rely on the library. The weakness is an example of inefficient algorithmic complexity (CWE‑407).

All installations of the andialbrecht:sqlparse package with a version earlier than 0.6.0 are vulnerable, including any Python applications that import or depend on sqlparse. The vulnerability is fixed in release 0.6.0 and later, so any users of older releases on any platform that runs Python are impacted.

The CVSS score of 5.1 indicates moderate severity, but the lack of an exploitable code path outside resource exhaustion means typical scanners cannot demonstrate remote code execution; instead the threat space is the potential for local or remote users to supply malicious SQL strings. EPSS is unavailable, and the issue is not currently listed in CISA KEV, suggesting no publicly available exploit code. Nevertheless, any public‑facing service that processes user‑provided SQL statements with sqlparse and uses reindent=True remains at risk if the attacker can craft large or complex tuple lists, since the attack can be performed without authentication and will exhaust CPU resources, compromising availability.