CVE-2026-84305: CVE-2026-84305: Algorithmic Complexity Vulnerability (ReindentFilter CPU Exhaustion) in sqlparse

#security #cve #cybersecurity

CVE-2026-84305: Algorithmic Complexity Vulnerability (ReindentFilter CPU Exhaustion) in sqlparse

Vulnerability ID: CVE-2026-84305
CVSS Score: 5.1
Published: 2026-09-01

An algorithmic complexity vulnerability in the python sqlparse library versions before 0.6.0 allows an attacker to cause high CPU usage and denial of service via a crafted SQL statement during formatting.

TL;DR

The sqlparse library contains an O(N^2) complexity flaw in its reindentation filter, allowing small crafted SQL payloads to trigger CPU exhaustion and denial of service.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-407
Attack Vector: Local / Remote (via untrusted SQL input formatting)
CVSS v4.0 Score: 5.1
Exploit Maturity: Proof-of-Concept
KEV Status: Not Listed
Ransomware Association: No

Affected Systems

sqlparse (Python package)
sqlparse: < 0.6.0 (Fixed in: 0.6.0)

Code Analysis

Commit: a51df6d

Fix ReindentFilter CPU exhaustion vector (GHSA-cfqr-cjx5-5jcm)

Mitigation Strategies

Upgrade sqlparse to version 0.6.0 or newer.
Disable the opt-in 'reindent=True' formatting parameter when handling untrusted user input.

Remediation Steps:

Identify all Python environments running sqlparse versions older than 0.6.0.
Execute 'pip install --upgrade sqlparse>=0.6.0' to upgrade the package.
Audit application source code for instances of 'sqlparse.format(..., reindent=True)' and modify configuration if upgrading cannot be done immediately.

References

Read the full report for CVE-2026-84305 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community