CyberRota Analysis
AI-GeneratedThe sqlparse module for Python is vulnerable to a denial-of-service attack due to inefficient handling of unmatched dollar-quoted literals and multiline-comment delimiters, leading to excessive CPU consumption during parsing operations. This vulnerability can severely impact applications relying on sqlparse for SQL parsing, particularly those that process untrusted input. Developers and organizations using versions prior to 0.6.0 should prioritize upgrading to mitigate potential performance degradation and service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.