CVE-2026-54284: sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sqlparseto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54284?
CVE-2026-54284 has a risk score of 37, indicating a moderate potential for exploitation.
How do I fix CVE-2026-54284?
To fix CVE-2026-54284, update sqlparse to version 0.6.0 or higher.
What does CVE-2026-54284 affect?
CVE-2026-54284 affects the sqlparse module used for parsing SQL in Python applications.
What kind of attack can CVE-2026-54284 lead to?
CVE-2026-54284 can lead to a CPU Denial of Service (DoS) due to excessive CPU consumption.
When was CVE-2026-54284 published?
CVE-2026-54284 was published on August 17, 2026.