{"id":"CVE-2026-84305","title":"sqlparse is a non-validating SQL parser module for Python","summary":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/…","severity":"medium","cwe":["CWE-407","CWE-770"],"vendor":"sqlparse","product":"sqlparse","affected":["sqlparse <= 0.5.5"],"patched":["sqlparse 0.6.0"],"published":"2026-09-01","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84305","references":[{"url":"https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b","label":"security-advisories@github.com"},{"url":"https://github.com/andialbrecht/sqlparse/releases/tag/0.6.0","label":"security-advisories@github.com"},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm","label":"security-advisories@github.com"},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-cfqr-cjx5-5jcm"},{"url":"https://github.com/andialbrecht/sqlparse"},{"url":"https://pypi.org/project/sqlparse"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84305"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84305.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84305"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526954"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84305"}],"tags":["nvd","ghsa","pip","osv","csaf","vex","red-hat"],"epss":0.00189,"epssPercentile":0.08447,"aliases":["GHSA-cfqr-cjx5-5jcm","PYSEC-2026-3923"],"ecosystem":"pip","ingestedAt":"2026-09-01T21:32:41.556Z","cvss":6.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","slug":"CVE-2026-84305","body":"## Overview\n\nsqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-84305)\n\nAffected packages:\n\n- `sqlparse <= 0.5.5`\n\nPatched in:\n\n- `sqlparse 0.6.0`\n\nSource: https://github.com/advisories/GHSA-cfqr-cjx5-5jcm\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · updated 2026-10-05 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84305.json)","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":215692,"id":"CVE-2026-84305","ts":1791187463808,"field":"cvss","old":null,"new":"6.2"}]}