CVE-2026-84305: sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset() in sqlparse/filters/reindent.py, where flattenuptotoken() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAXGROUPINGTOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sqlparseto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications that use sqlparse to format attacker-controlled SQL with sqlparse.format(sql, reindent=True), or expose the sqlformat command with the --reindent option, are exposed. The impact is CPU exhaustion that can delay requests, reduce throughput, or starve workers.
What input or access does an attacker need?
An attacker needs to supply SQL that reaches reindentation and contains parenthesized tuple lists engineered to trigger many offset calculations. The described inputs can remain below MAX_GROUPING_TOKENS.
Are default sqlparse parsing operations affected?
The issue is specifically described in the reindentation paths: sqlparse.format(sql, reindent=True) and sqlformat --reindent. The provided information does not identify other parsing or formatting configurations as affected.
What should be done if upgrading cannot happen immediately?
Avoid applying reindentation to attacker-controlled SQL by disabling reindent=True and not exposing sqlformat --reindent to untrusted input. Upgrade to sqlparse 0.6.0 when possible.
How can teams determine whether they may already be affected?
Review application code and operational tooling for sqlparse.format calls that set reindent=True and for sqlformat invocations using --reindent on untrusted SQL. Review performance incidents for high CPU, request delays, reduced throughput, or worker starvation associated with formatting inputs containing large parenthesized tuple lists.