---
id: CVE-2026-54284
title: sqlparse is a non-validating SQL parser module for Python
summary: >-
  sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0,
  TokenList construction and string conversion in sqlparse/sql.py repeatedly
  flatten nested token subtrees constructed by group_parenthesis and group_case,
  causing …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-407
  - CWE-1333
vendor: sqlparse
product: sqlparse
affected:
  - sqlparse < 0.6.0
patched:
  - sqlparse 0.6.0
published: '2026-08-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54284'
references:
  - url: >-
      https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f
    label: security-advisories@github.com
  - url: >-
      https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f
    label: security-advisories@github.com
  - url: >-
      https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/andialbrecht/sqlparse'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54284.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-54284'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517527'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-54284'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54284'
  - url: 'https://access.redhat.com/errata/RHSA-2026:61783'
  - url: 'https://github.com/advisories/GHSA-pwgv-4x5q-6m9f'
tags:
  - nvd
  - osv
  - pip
  - csaf
  - vex
  - red-hat
  - ghsa
epss: 0.00332
epssPercentile: 0.23766
aliases:
  - GHSA-pwgv-4x5q-6m9f
  - PYSEC-2026-3699
ecosystem: pip
cvssSource: vendor
ingestedAt: '2026-08-17T17:58:10.177Z'
---

## Overview

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54284)

Affected packages:

- `sqlparse < 0.6.0`

Patched in:

- `sqlparse 0.6.0`

Source: https://osv.dev/vulnerability/GHSA-pwgv-4x5q-6m9f

## Vendor advisories

- **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783)
- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Update Infrastructure 4 for Cloud Providers, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, … · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54284.json)