CVE-2026-84305

Quadratic CPU DoS in sqlparse reindent causing slowdown and worker starvation

• CVSS 5.1
• 407
• Resource Management
• Remote

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat –reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.

CVE

CVE-2026-84305

CWE

407

CVSS base score

5.1

Published

2026-09-01

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Timing/Serialization

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade sqlparse to version 0.6.0 or later.

import sqlparse

def format_sql(user_sql: str) -> str:
    # VULNERABLE: Reindenting attacker‑controlled SQL triggers quadratic parsing
    return sqlparse.format(user_sql, reindent=True, keyword_case='upper')

import sqlparse

def format_sql(user_sql: str) -> str:
    # FIX: Disable reindent to avoid costly token tree expansion on untrusted input
    return sqlparse.format(user_sql, reindent=False, keyword_case='upper')

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202684305,
  title        = {{Quadratic CPU DoS in sqlparse reindent causing slowdown and worker starvation}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-84305},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-84305/}}
}