High CPU Consumption Vulnerability in sqlparse Package
Summary
DEBIAN-CVE-2026-54284: sqlparse is a non-validating SQL parser module for Python. Affects sqlparse versions 0.4.1-1 – 0.5.5-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser module for Python, widely used for parsing SQL statements. It allows developers to work with SQL in a more manageable way, providing features such as tokenization and formatting. However, prior to version 0.6.0, sqlparse had a significant vulnerability that could lead to excessive CPU consumption when processing deeply nested SQL queries.
Vulnerability Detail
The vulnerability arises from the way TokenList construction and string conversion are handled in sqlparse/sql.py. Specifically, the library repeatedly flattens nested token subtrees created by group_parenthesis and group_case. This behavior can lead to quadratic CPU consumption during the execution of functions like sqlparse.parse(), sqlparse.format(), and sqlparse.split(). As a result, users may experience severe performance degradation, especially with complex SQL queries. The issue is mitigated in version 0.6.0, which introduces a fix to prevent such excessive resource consumption.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you are unable to update the sqlparse package immediately, consider avoiding deeply nested SQL queries or simplifying your SQL statements to reduce the risk of triggering the vulnerability. Additionally, monitoring your application's performance during SQL parsing can help identify potential issues early.
Conclusion
The sqlparse package has a vulnerability that can lead to high CPU consumption due to inefficient handling of nested SQL queries. Updating to version 0.6.0 or later is crucial to mitigate this issue. Users are encouraged to monitor their applications and consider using tools like Vulert to stay informed about vulnerabilities.
See every vulnerability recorded for sqlparse →
FAQ
sqlparse is a Python library that provides a non-validating SQL parser, allowing developers to parse, format, and manipulate SQL statements easily.
The vulnerability leads to excessive CPU consumption when processing nested SQL queries, potentially causing performance issues in applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability is fixed in sqlparse version 0.6.0 and later. Updating to this version will resolve the issue.
If an immediate update is not possible, consider simplifying your SQL queries and monitoring your application's performance to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
