CVE-2026-54284: sqlparse Python Module DOS Vulnerability

CVE-2026-54284 Overview

CVE-2026-54284 is an algorithmic complexity vulnerability in sqlparse, a non-validating SQL parser module for Python. Versions prior to 0.6.0 repeatedly flatten nested token subtrees during TokenList construction and string conversion in sqlparse/sql.py. The group_parenthesis and group_case routines trigger quadratic CPU consumption when processing crafted SQL input. Attackers can exhaust CPU resources through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. The maintainers fixed the issue in version 0.6.0. This weakness maps to [CWE-407: Inefficient Algorithmic Complexity].

Critical Impact
Remote attackers can send crafted SQL strings to any application using vulnerable sqlparse versions and force sustained CPU exhaustion, resulting in denial of service.

Affected Products

sqlparse Python module versions prior to 0.6.0
Python applications parsing untrusted SQL through sqlparse.parse(), sqlparse.format(), or sqlparse.split()
Downstream projects that embed sqlparse for query linting, formatting, or migration tooling

Discovery Timeline

2026-08-17 - CVE-2026-54284 published to NVD
2026-08-17 - Last updated in NVD database

Technical Details for CVE-2026-54284

Vulnerability Analysis

The defect resides in the TokenList class inside sqlparse/sql.py. During initialization, the class invoked str(self) to compute a string representation of the group. This call recursively walked every nested child token and re-serialized already-flattened subtrees. When group_parenthesis and group_case build deeply nested groupings from complex SQL, the parser performs redundant traversals for each level, producing O(n²) work relative to input size.

An attacker crafts SQL containing deeply nested parentheses or CASE expressions. Each additional nesting level multiplies work performed by the parser. CPU consumption grows quadratically until the module's internal depth and token limits stop processing, but not before consuming enough compute to degrade or halt the host process.

Root Cause

The TokenList.__init__ method computed its value by stringifying the entire nested structure through str(self), which itself recursively concatenated child string values. Each nested TokenList repeated this work for its parent, producing quadratic reprocessing of the same tokens.

Attack Vector

Exploitation requires only the ability to submit SQL text to a service that calls sqlparse on user input. Web applications, ORM migration tools, query previews, log parsers, and SQL linters that process untrusted input are exposed over the network without authentication or user interaction.

python

# Patch from sqlparse/sql.py — avoids recursive str(self) during construction
    def __init__(self, tokens=None):
        self.tokens = tokens or []
        [setattr(token, 'parent', self) for token in self.tokens]
-       super().__init__(None, str(self))
+       super().__init__(None, ''.join(token.value for token in self.tokens))
        self.is_group = True

    def __str__(self):

Source: GitHub Commit 939b129. The fix constructs the group value directly from the immediate child token values, eliminating the recursive re-flattening.

Detection Methods for CVE-2026-54284

Indicators of Compromise

Sustained high CPU utilization in Python worker processes that call sqlparse.parse(), sqlparse.format(), or sqlparse.split()
HTTP request payloads or API parameters containing SQL with unusually deep parenthesis nesting or long CASE chains
Request latency spikes correlated with SQL-handling endpoints and eventual worker timeouts or restarts

Detection Strategies

Inventory Python dependencies for sqlparse versions below 0.6.0 using pip list, pip-audit, or SBOM tooling
Instrument application code paths that call sqlparse to log input size and parse duration, then alert on outliers
Inspect web application firewall logs for SQL payloads with abnormal nesting depth against endpoints that pass input to sqlparse

Monitoring Recommendations

Track per-request CPU time and wall-clock duration for endpoints handling SQL text
Alert on repeated worker timeouts, SIGKILL events, or OOM conditions in services that embed sqlparse
Correlate spikes in 5xx errors with source IPs submitting large or nested SQL payloads

How to Mitigate CVE-2026-54284

Immediate Actions Required

Upgrade sqlparse to version 0.6.0 or later across all Python environments and container images
Rebuild and redeploy applications and lambda functions that pin an earlier sqlparse release through transitive dependencies
Enforce request-level CPU and timeout limits on services that parse untrusted SQL input

Patch Information

The upstream fix is committed as 939b129 and is included in sqlparse 0.6.0. Review the GitHub Security Advisory GHSA-pwgv-4x5q-6m9f and the GitHub Commit 939b129 for full technical detail. No configuration change is required after upgrading.

Workarounds

Cap the length of SQL input accepted from untrusted sources before invoking sqlparse
Reject or sanitize SQL payloads exceeding a reasonable parenthesis or CASE nesting depth
Run parsing calls inside a subprocess or thread with a strict CPU timeout to bound worst-case processing

bash

# Upgrade sqlparse to the fixed release
pip install --upgrade 'sqlparse>=0.6.0'

# Verify installed version
python -c "import sqlparse; print(sqlparse.__version__)"

# Audit dependency tree for pinned vulnerable versions
pip-audit