Denial of Service in sqlparse
Summary
CVE-2024-4340: sqlparse parsing heavily nested list leads to Denial of Service. Affects sqlparse versions < 0.5.0. Fixed in 0.5.0. How to fix ↓
Also tracked for
- sqlparse · Debian:11
The same CVE-2024-4340 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a Python library used for parsing SQL statements. It provides functionality to analyze and manipulate SQL queries. The library is commonly used in applications that interact with databases. However, a vulnerability has been discovered in sqlparse that can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in sqlparse arises when a heavily nested list is passed to the sqlparse.parse() function. This triggers a recursion error, causing the program to exceed the maximum recursion depth and resulting in a DoS condition. An attacker can exploit this vulnerability by providing a specially crafted input that triggers the excessive recursion, causing the application to become unresponsive or crash. The impact of this vulnerability depends on the context in which sqlparse is used, but it can potentially disrupt the availability of the affected application.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
pip install --upgrade "sqlparse==0.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0
This is the first release that contains the fix.
pip install --upgrade "sqlparse==0.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid passing heavily nested lists to the sqlparse.parse() function. By ensuring that the input does not trigger excessive recursion, the vulnerability can be mitigated. However, this workaround may not be feasible in all scenarios, especially when the input is controlled by external sources.
Conclusion
The vulnerability in sqlparse can lead to a Denial of Service (DoS) condition when a heavily nested list is passed to the parse() function. It is recommended to apply the suggested fix by modifying the flatten() function to limit recursion depth. Users can also consider the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlparse →
FAQ
sqlparse is a Python library used for parsing SQL statements. It provides functionality to analyze and manipulate SQL queries.
The vulnerability can lead to a Denial of Service (DoS) condition, potentially disrupting the availability of the affected application.
An attacker can exploit this vulnerability by providing a specially crafted input that triggers excessive recursion, causing the application to become unresponsive or crash.
Yes, a fix is available for this vulnerability. It involves modifying the flatten() function in the TokenList class of sqlparse to limit the recursion depth.
A workaround is to avoid passing heavily nested lists to the sqlparse.parse() function. However, this may not be feasible in all scenarios.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
