CyberRota Analysis
AI-GeneratedThe sqlparse module for Python is vulnerable to a performance issue that can lead to quadratic CPU consumption when processing attacker-controlled inputs, specifically through the `format` function with reindentation enabled. This can result in significant request delays, reduced throughput, or even worker starvation in affected applications. Organizations using versions prior to 0.6.0 should prioritize upgrading to mitigate potential denial-of-service impacts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.