CVE-2026-54284: sqlparse CPU DoS Vulnerability Due to Inefficient Token Grouping
Summary
CVE-2026-54284: sqlparse ships hard limits (MAX_GROUPING_DEPTH=100, MAX_GROUPING_TOKENS=10000) intended to bound parsing work on attacker-supplied SQL, but the path that *reaches* those limits is itself O(n*depth) per token-group constr... Affects sqlparse versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser for Python that provides a way to parse, format, and split SQL statements. It is widely used in various applications, including web services and database management tools. The package is designed to handle SQL queries efficiently, but it has a vulnerability that can lead to excessive CPU consumption when processing deeply nested SQL statements.
Vulnerability Detail
The vulnerability arises from the implementation of the TokenList class in sqlparse, specifically in the init method. When constructing token groups, the method calls super().init(None, str(self)), which triggers a costly operation that flattens the entire subtree of tokens. This results in a time complexity of O(n*depth) for each token group, where n is the number of tokens and depth is the nesting level. Attackers can exploit this by sending specially crafted SQL payloads with deep nesting, causing significant CPU load and potentially leading to denial of service (DoS) conditions. The vulnerability affects sqlparse version 0.5.5 and earlier, with a CVSS score of 8.7 indicating a high severity.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
pip install --upgrade "sqlparse==0.6.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing SQL queries that contain deeply nested structures, such as excessive parentheses or CASE statements. Additionally, implement rate limiting on SQL parsing requests to mitigate the impact of potential DoS attacks.
Conclusion
The sqlparse vulnerability CVE-2026-54284 poses a significant risk due to its potential for CPU DoS attacks through deeply nested SQL queries. It is crucial for users of sqlparse to update to the latest version to mitigate this risk and ensure the stability of their applications.
See every vulnerability recorded for sqlparse →
FAQ
The vulnerability can lead to significant CPU consumption, causing slowdowns or crashes in applications that rely on sqlparse for SQL parsing.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
sqlparse versions 0.5.5 and earlier are affected by this vulnerability.
If an immediate update is not possible, consider implementing rate limiting and avoiding deeply nested SQL queries as a temporary measure.
Yes, a patch is available in sqlparse version 0.6.0 and later, which addresses the performance issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
