SQL Parsing Performance Degradation in sqlparse Package - CVE-2026-84305
Summary
DEBIAN-CVE-2026-84305: sqlparse is a non-validating SQL parser module for Python. Affects sqlparse versions 0.4.2-1 – 0.5.5-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser module for Python, widely used for parsing SQL statements. It allows developers to format and manipulate SQL queries easily. However, prior to version 0.6.0, sqlparse had a significant performance vulnerability that could lead to excessive CPU consumption under certain conditions.
Vulnerability Detail
The vulnerability arises from the way sqlparse handles parenthesized tuple lists during formatting. When using the sqlparse.format function with the reindent option enabled, the method ReindentFilter._get_offset() can be exploited. Specifically, the _flatten_up_to_token() function repeatedly rebuilds and joins the statement prefix, leading to thousands of offset calculations that traverse an expanding token tree. This results in quadratic CPU consumption, causing request delays, reduced throughput, or even worker starvation, especially with inputs that remain below the MAX_GROUPING_TOKENS threshold.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the reindent option in sqlparse.format or refrain from processing large parenthesized tuple lists until the package is updated to the patched version.
Conclusion
The sqlparse package has a critical vulnerability (CVE-2026-84305) that can lead to performance issues due to inefficient SQL formatting. Users are advised to update to version 0.6.0 or later to mitigate this risk. For those unable to update immediately, a temporary workaround is available.
See every vulnerability recorded for sqlparse →
FAQ
CVE-2026-84305 is a vulnerability in the sqlparse package that can lead to excessive CPU consumption due to inefficient handling of SQL formatting.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
The vulnerability can cause significant performance degradation, leading to request delays and reduced application throughput, which may affect user experience.
Yes, the vulnerability is fixed in sqlparse version 0.6.0 and later. It is recommended to update to this version to mitigate the issue.
If an immediate update is not possible, consider avoiding the use of the reindent option in sqlparse.format as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
