CVE-2026-54284: CVE-2026-54284: Algorithmic Complexity Exhaustion in sqlparse Engine

#security #cve #cybersecurity

CVE-2026-54284: Algorithmic Complexity Exhaustion in sqlparse Engine

Vulnerability ID: CVE-2026-54284
CVSS Score: 8.7
Published: 2026-08-17

An algorithmic complexity vulnerability in the python-sqlparse library allows remote, unauthenticated attackers to cause a Denial of Service (DoS) via resource exhaustion. By transmitting a carefully constructed SQL statement containing deeply nested structures, an attacker can trigger quadratic CPU consumption within the parsing engine. This behavior bypasses the built-in depth limits because the performance degradation occurs during the initial recursive tree construction, causing the application process to hang.

TL;DR

A vulnerability in the python-sqlparse library before version 0.6.0 allows remote attackers to cause a complete Denial of Service (DoS) via high CPU utilization. This is achieved by sending crafted SQL strings with deeply nested structures, which bypass the parser's defensive limits and trigger quadratic processing complexity.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-407
Attack Vector: Network
CVSS v4.0 Score: 8.7
Exploit Status: poc
CISA KEV Status: No
Remediation Priority: High

Affected Systems

Applications utilizing the python-sqlparse library to parse, format, or analyze SQL strings.
Web Application Firewalls (WAFs) and security utilities using python-sqlparse for SQL injection detection.
Database administration panels and query formatting interfaces running vulnerable Python backends.
sqlparse: < 0.6.0 (Fixed in: 0.6.0)

Code Analysis

Commit: 939b129

Fix performance degradation issue when parsing deeply nested SQL statements.

@@ -164,7 +164,7 @@ class TokenList(Token):
     def __init__(self, tokens=None):
         self.tokens = tokens or []
         [setattr(token, 'parent', self) for token in self.tokens]
-        super().__init__(None, str(self))
+        super().__init__(None, ''.join(token.value for token in self.tokens))
         self.is_group = True

     def __str__(self):
@@ -327,7 +327,7 @@ def group_tokens(self, grp_cls, start, end, include_end=True,
             grp = start
             grp.tokens.extend(subtokens)
             del self.tokens[start_idx + 1:end_idx]
-            grp.value = str(start)
+            grp.value += ''.join(token.value for token in subtokens)
         else:
             subtokens = self.tokens[start_idx:end_idx]
             grp = grp_cls(subtokens)

Mitigation Strategies

Upgrade sqlparse package to version 0.6.0 or newer to patch the underlying recursive parsing behavior.
Implement rate-limiting on endpoints that accept and process raw SQL inputs.
Deploy input-length restrictions at the API gateway layer to prevent oversized payloads.
Configure aggressive worker timeouts in the WSGI/ASGI application server configuration to auto-recycle locked threads.

Remediation Steps:

Identify all internal services and libraries that depend on the sqlparse Python package.
Update your project's dependency definition file (e.g., requirements.txt, Pipfile, or pyproject.toml) to reference sqlparse>=0.6.0.
Rebuild and redeploy application containers to apply the updated library package.
Verify the patch execution by running a regression test using a moderately nested SQL test case to ensure parsing completes instantaneously.

References

Fix Commit in andialbrecht/sqlparse Repository

Read the full report for CVE-2026-54284 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community