CVE-2026-84305

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-84305
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84305.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-84305
Aliases
Downstream
Published
2026-09-01T18:33:10.969Z
Modified
2026-09-02T03:47:23.069891288Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Details

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset() in sqlparse/filters/reindent.py, where flattenuptotoken() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAXGROUPINGTOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84305.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-407"
    ]
}
References

Affected packages

Git / github.com/andialbrecht/sqlparse

Affected ranges

Type
GIT
Repo
https://github.com/andialbrecht/sqlparse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2f40da99b50d81135aecf96f6b08fcfa338a96de
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.6.0"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.2
0.1.3
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84305.json"