{"id":"CVE-2026-84305","title":"sqlparse is a non-validating SQL parser module for Python","summary":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/…","severity":"medium","cwe":["CWE-407"],"vendor":"sqlparse","product":"sqlparse","affected":["sqlparse <= 0.5.5"],"patched":["sqlparse 0.6.0"],"published":"2026-09-01","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84305","references":[{"url":"https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b","label":"security-advisories@github.com"},{"url":"https://github.com/andialbrecht/sqlparse/releases/tag/0.6.0","label":"security-advisories@github.com"},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm","label":"security-advisories@github.com"},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-cfqr-cjx5-5jcm"},{"url":"https://github.com/andialbrecht/sqlparse"},{"url":"https://pypi.org/project/sqlparse"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84305"}],"tags":["nvd","ghsa","pip","osv"],"epss":0.00125,"epssPercentile":0.02581,"aliases":["GHSA-cfqr-cjx5-5jcm","PYSEC-2026-3923"],"ecosystem":"pip","ingestedAt":"2026-09-01T21:32:41.556Z","slug":"CVE-2026-84305","body":"## Overview\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-84305)\n\nAffected packages:\n\n- `sqlparse <= 0.5.5`\n\nPatched in:\n\n- `sqlparse 0.6.0`\n\nSource: https://github.com/advisories/GHSA-cfqr-cjx5-5jcm","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}