CVE-2021-32839: SQL Injection Vulnerability in sqlparse
Summary
CVE-2021-32839: sqlparse is a non-validating SQL parser module for Python. Affects sqlparse across 2 version ranges.
>= 0.4.0, < 0.4.2
>= 1499cffcd7c4d635b4297b44d48fb4fe94cf988e, < 8238a9e450ed1524e40cb3a8b0b3c00606903aeb
Fixed in 8238a9e450ed1524e40cb3a8b0b3c00606903aeb. How to fix ↓
Also tracked for
- sqlparse · Debian:11
The same CVE-2021-32839 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
sqlparse is a non-validating SQL parser module for Python. It provides functionality to parse and manipulate SQL statements. The package is commonly used in Python applications that interact with databases. However, versions 0.4.0 and 0.4.1 of sqlparse are vulnerable to a regular Expression Denial of Service (ReDoS) attack. This vulnerability affects the formatting feature of sqlparse that removes comments from SQL statements.
Vulnerability Detail
The vulnerability in sqlparse arises from a regular expression that can cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. An attacker can exploit this vulnerability by crafting a malicious SQL statement with a large number of '\r\n' repetitions in the comments. When the formatting feature with the 'strip_comments=True' option is used, the exponential backtracking can lead to a Denial of Service (DoS) condition, impacting the performance of the application. This vulnerability does not directly lead to SQL injection attacks or data leakage.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
pip install --upgrade "sqlparse==0.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8238a9e450ed1524e40cb3a8b0b3c00606903aeb
This is the first release that contains the fix.
pip install --upgrade "sqlparse==8238a9e450ed1524e40cb3a8b0b3c00606903aeb"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is available. Avoid using the 'sqlformat.format' function with the 'strip_comments=True' keyword argument or the '--strip-comments' command line flag when using the 'sqlformat' command line tool. By not stripping comments, the vulnerable regular expression is not triggered, mitigating the risk of a DoS attack. However, it is still recommended to upgrade to the fixed version as soon as possible.
Conclusion
The sqlparse package versions 0.4.0 and 0.4.1 are vulnerable to a regular Expression Denial of Service (ReDoS) attack. This vulnerability can lead to a Denial of Service (DoS) condition, impacting the performance of the application. It is recommended to upgrade to sqlparse version 0.4.2 or later to fix the vulnerability. If immediate upgrade is not possible, the workaround of avoiding the 'strip_comments=True' option can be used. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlparse →
FAQ
sqlparse is a Python module that provides functionality to parse and manipulate SQL statements. It is commonly used in Python applications that interact with databases.
Versions 0.4.0 and 0.4.1 of sqlparse are affected by this vulnerability.
The vulnerability can lead to a Denial of Service (DoS) condition, impacting the performance of the application. However, it does not directly lead to SQL injection attacks or data leakage.
To fix this vulnerability, it is recommended to upgrade to sqlparse version 0.4.2 or later. You can update the package by running the command 'pip install --upgrade sqlparse'.
Yes, if upgrading to the latest version is not immediately feasible, you can avoid using the 'sqlformat.format' function with the 'strip_comments=True' keyword argument or the '--strip-comments' command line flag when using the 'sqlformat' command line tool. By not stripping comments, the vulnerable regular expression is not triggered, mitigating the risk of a DoS attack.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
