CVE-2026-54284: sqlparse CPU DoS Vulnerability Due to Inefficient Token Grouping
Summary
CVE-2026-54284: sqlparse ships hard limits (MAX_GROUPING_DEPTH=100, MAX_GROUPING_TOKENS=10000) intended to bound parsing work on attacker-supplied SQL, but the path that *reaches* those limits is itself O(n*depth) per token-group constr... Affects sqlparse versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a popular Python library used for parsing SQL statements. It provides functionalities for formatting, splitting, and analyzing SQL queries. The library is widely utilized in web applications and frameworks, such as Django, for handling SQL queries. However, it has a vulnerability that can lead to excessive CPU consumption when processing deeply nested SQL constructs, making it susceptible to denial-of-service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from the implementation of the TokenList class in sqlparse, specifically in the init method. The method calls super().init(None, str(self)), which triggers a costly operation that flattens the entire subtree of tokens for every group of tokens created. This results in a time complexity of O(n*depth), where n is the number of tokens and depth is the nesting level. Attackers can exploit this by sending specially crafted SQL queries with deep nesting, causing the parser to consume excessive CPU resources before hitting the defined limits. The impact can be severe, leading to service degradation or complete unavailability, especially in multi-threaded environments where multiple requests can overwhelm the server.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
pip install --upgrade "sqlparse==0.6.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the depth of nested SQL queries processed by your application. Additionally, consider implementing rate limiting on the SQL parsing endpoints to mitigate the impact of potential DoS attacks.
Conclusion
The sqlparse library has a critical vulnerability (CVE-2026-54284) that can be exploited to cause CPU denial-of-service attacks through deeply nested SQL queries. It is crucial for users of this library to update to version 0.6.0 or later to mitigate this issue. Additionally, implementing workarounds can help reduce the risk until an update can be applied.
See every vulnerability recorded for sqlparse →
FAQ
CVE-2026-54284 is a vulnerability in the sqlparse library that allows attackers to exploit inefficient token grouping, leading to excessive CPU consumption and potential denial-of-service (DoS) conditions.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to analyze your application's dependencies.
The vulnerability can lead to significant CPU resource consumption, causing slowdowns or crashes in applications that rely on sqlparse for SQL parsing, especially under heavy load or with malicious input.
Yes, a patch is available in sqlparse version 0.6.0 and later. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, consider implementing rate limiting on SQL parsing requests and monitoring for unusual activity to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
