Vulnerability in sqlparse (CVE-2026-54284)
Summary
Vulnerability in sqlparse (CVE-2026-54284). Risk of unauthorized operations or information disclosure. Exploitable via sqlparse. Mitigation: upgrade to 0.6.0 or later.
Original description
The description as published by the source.
Summary
sqlparse ships hard limits (MAX_GROUPING_DEPTH=100, MAX_GROUPING_TOKENS=10000) intended to bound parsing work on attacker-supplied SQL, but the path that reaches those limits is itself O(n*depth) per token-group construction. A ~1-2 KB SQL payload (e.g. SELECT (((((1))))) ... with 500-2000 nesting levels, or a 200-400-level nested CASE WHEN chain) drives the parser to spend multiple seconds of CPU before the depth cap raises SQLParseError. Concretely: a 2 KB malicious payload consumes ~10 seconds of CPU per request on a single worker (~5000x CPU-to-input amplification), while a benign 1 KB SQL completes in ~3 ms.
The root cause is TokenList.__init__ calling super().__init__(None, str(self)). TokenList.__str__ flattens the entire subtree on every call, and grouping constructs a new TokenList for every parenthesis / CASE / list group, so a tree of depth d with n total tokens performs O(n*d) flatten work just to materialize the cached value field, which is then never read for grouped nodes (they override __str__).
This is a distinct quadratic from the input-size caps added in GHSA-2m57-hf25-phgg / GHSA-27jp-wm6q-gp25: those caps prevent unbounded work, but the time required to trigger the caps is itself superlinear in payload size.
Affected components
sqlparse 0.5.5 (latest) and every prior version that ships TokenList.__init__. The offending line has existed since the introduction of the cached-value invariant; the re…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-54284 has been found in sqlparse.
Attackers can target a specific entry point like sqlparse over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade sqlparse to 0.6.0 or later.
If unsure, ask your IT team or search "sqlparse CVE-2026-54284" on the vendor's site.
CVE-2026-54284 (sqlparse) — CWE-407
Attack surface: sqlparse / SQLParseError / TokenList.__init__ / TokenList.__str__
Patched: 0.6.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-407) exists in sqlparse. Attackers reach the vulnerable code path via sqlparse.
Check the vendor advisory for the affected versions of sqlparse. Attack surface: sqlparse / SQLParseError / TokenList.__init__ / TokenList.__str__.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 0.6.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'sqlparse' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'sqlparse' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
sqlparseを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade sqlparse to 0.6.0ステージング環境で 0.6.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-54284 sqlparse
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- package pypi.org
- web github.com
- web github.com