Duplicate Advisory: Denial of Service in sqlparse
Summary
GHSA-62qf-jcq8-8gxw: Duplicate Advisory: sqlparse parsing heavily nested list leads to Denial of Service. Affects sqlparse versions < 0.5.0. Fixed in 0.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a Python library used for parsing SQL statements. It provides functionality to analyze and manipulate SQL queries. The library is commonly used in applications that interact with databases. However, a vulnerability has been discovered in sqlparse that can lead to a Denial of Service (DoS) attack when parsing heavily nested lists.
Vulnerability Detail
The vulnerability in sqlparse arises when a heavily nested list is passed to the sqlparse.parse() function. This triggers a RecursionError, causing the application to crash or become unresponsive. An attacker can exploit this vulnerability by crafting a malicious SQL query with a deeply nested list, leading to a DoS condition. The impact of this vulnerability is a disruption of service, potentially affecting the availability of the application.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
pip install --upgrade "sqlparse==0.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0
This is the first release that contains the fix.
pip install --upgrade "sqlparse==0.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating the sqlparse library to the latest version is the recommended solution.
Conclusion
The sqlparse library is vulnerable to a Denial of Service (DoS) attack when parsing heavily nested lists. To mitigate this vulnerability, it is crucial to update the library to version 0.5.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlparse →
FAQ
sqlparse is a Python library used for parsing SQL statements. It provides functionality to analyze and manipulate SQL queries.
The vulnerability can lead to a Denial of Service (DoS) attack, causing the application to crash or become unresponsive.
An attacker can exploit this vulnerability by crafting a malicious SQL query with a deeply nested list, leading to a DoS condition.
To fix this vulnerability, update the sqlparse library to version 0.5.0 or later.
There is no specific workaround mentioned for this vulnerability. Updating the sqlparse library to the latest version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
