{"id":"GHSA-27jp-wm6q-gp25","title":"sqlparse: formatting list of tuples leads to denial of service","summary":"sqlparse: formatting list of tuples leads to denial of service","severity":"medium","vendor":"sqlparse","product":"sqlparse","ecosystem":"pip","affected":["sqlparse < 0.5.4"],"patched":["sqlparse 0.5.4"],"published":"2026-02-13","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:33.710557518Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-27jp-wm6q-gp25","references":[{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-27jp-wm6q-gp25"},{"url":"https://github.com/andialbrecht/sqlparse/commit/40ed3aa958657fa4a82055927fa9de70ab903360"},{"url":"https://github.com/andialbrecht/sqlparse"},{"url":"https://github.com/andialbrecht/sqlparse/releases/tag/0.5.4"}],"tags":["osv","pip"],"ingestedAt":"2026-09-12T03:13:01.633Z","slug":"GHSA-27jp-wm6q-gp25","body":"## Overview\n\n### Summary\nThe below gist hangs while attempting to format a long list of tuples.\n\nThis was found while [drafting a regression test for Dja\nngo 5.2's composite primary key feature](https://code.djangoproject.com/ticket/36416#comment:3), which allows querying composite fields with tuples.\n\n###\n\n## Affected packages\n\n- `sqlparse < 0.5.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `sqlparse 0.5.4`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}