---
id: GHSA-27jp-wm6q-gp25
title: 'sqlparse: formatting list of tuples leads to denial of service'
summary: 'sqlparse: formatting list of tuples leads to denial of service'
severity: medium
vendor: sqlparse
product: sqlparse
ecosystem: pip
affected:
  - sqlparse < 0.5.4
patched:
  - sqlparse 0.5.4
published: '2026-02-13'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:33.710557518Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-27jp-wm6q-gp25'
references:
  - url: >-
      https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-27jp-wm6q-gp25
  - url: >-
      https://github.com/andialbrecht/sqlparse/commit/40ed3aa958657fa4a82055927fa9de70ab903360
  - url: 'https://github.com/andialbrecht/sqlparse'
  - url: 'https://github.com/andialbrecht/sqlparse/releases/tag/0.5.4'
tags:
  - osv
  - pip
ingestedAt: '2026-09-12T03:13:01.633Z'
---

## Overview

### Summary
The below gist hangs while attempting to format a long list of tuples.

This was found while [drafting a regression test for Dja
ngo 5.2's composite primary key feature](https://code.djangoproject.com/ticket/36416#comment:3), which allows querying composite fields with tuples.

###

## Affected packages

- `sqlparse < 0.5.4`

## Remediation

Upgrade to a patched release:

- `sqlparse 0.5.4`