CVE-2023-30608: sqlparse Regular Expression Denial of Service Vulnerability
Summary
CVE-2023-30608: sqlparse is a non-validating SQL parser module for Python. Affects sqlparse across 3 version ranges.
>= 0.1.15, < 0.4.4
< c457abd5f097dd13fb21543381e7cfafe7d31cfb
< e75e35869473832a1eb67772b1adfee2db11b85a
Fixed in c457abd5f097dd13fb21543381e7cfafe7d31cfb. How to fix ↓
Also tracked for
- sqlparse · Debian:11
The same CVE-2023-30608 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser module for Python. It provides functionality to parse and analyze SQL queries. The package is commonly used in Python applications that interact with SQL databases. However, in affected versions, the SQL parser module contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This vulnerability was introduced in commit 'e75e358'. The vulnerability may lead to Denial of Service (DoS) attacks, impacting the availability of the application.
Vulnerability Detail
The vulnerability in sqlparse arises from a regular expression that can be exploited for ReDoS attacks. An attacker can craft a malicious SQL query that triggers excessive backtracking in the regular expression, causing the parser to consume excessive CPU resources and leading to a DoS condition. This can result in the application becoming unresponsive or crashing. The vulnerability has been fixed in sqlparse 0.4.4 by commit 'c457abd5f'.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
pip install --upgrade "sqlparse==0.6.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
c457abd5f097dd13fb21543381e7cfafe7d31cfb
This is the first release that contains the fix.
pip install --upgrade "sqlparse==c457abd5f097dd13fb21543381e7cfafe7d31cfb"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The sqlparse package in Python is vulnerable to a Regular Expression Denial of Service (ReDoS) issue, which can lead to a Denial of Service (DoS) condition. Users are advised to upgrade to sqlparse version 0.4.4 or later to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlparse →
FAQ
sqlparse is a Python module that provides functionality to parse and analyze SQL queries. It is commonly used in Python applications that interact with SQL databases.
ReDoS stands for Regular Expression Denial of Service. It is a type of vulnerability where a maliciously crafted input can cause a regular expression to exhibit exponential time complexity, leading to excessive CPU usage and potential denial of service.
The vulnerability in sqlparse can be exploited by an attacker to cause a Denial of Service (DoS) condition. This can result in the application becoming unresponsive or crashing, impacting its availability.
To fix the vulnerability, it is recommended to upgrade to sqlparse version 0.4.4 or later. This can be done by updating the package using the package manager or by manually installing the latest version from the official PyPI repository.
There are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
