{"id":"CVE-2026-84305","aliases":["GHSA-cfqr-cjx5-5jcm"],"url":"https://o3.security/vulnerability/CVE-2026-84305","summary":"sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption","details":"sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.","published":"2026-09-01T18:33:10.969Z","modified":"2026-09-03T03:48:21.153629921Z","cvss":null,"epss":{"score":0.00125,"percentile":0.02511,"asOf":"2026-09-02"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"sqlparse","fixedVersion":"0.6.0"}],"fix":{"url":"https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b","label":"andialbrecht/sqlparse@a51df6d"},"references":[{"type":"WEB","url":"https://github.com/andialbrecht/sqlparse/releases/tag/0.6.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84305.json"},{"type":"ADVISORY","url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84305"},{"type":"FIX","url":"https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-03T03:48:21.153629921Z"}}