Listen to this Post
When SQL is formatted with reindentation enabled, the `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-token cap. Thousands of offset calculations then traverse an expanding token tree, causing multi-second CPU consumption from an input of roughly 16 KB and degrading service availability.
The vulnerable method, ReindentFilter._get_offset(), joins the tokens returned by `_flatten_up_to_token()` to calculate the current output position. Each call begins by flattening the current statement from its start and walks until the target token. Tuple-list reindentation invokes this calculation repeatedly as it processes many parenthesized values, so later calls redo an increasingly large amount of prior work.
The vulnerable path is reached through `sqlparse.format(sql, reindent=True)` and sqlformat --reindent. A carefully sized tuple list completes grouping below the configured token cap and then enters the expensive reindentation path; a slightly larger input may instead be rejected quickly by the cap.
Relevant code locations include:
– `sqlparse/formatter.py:170` — enabling `ReindentFilter`
– `sqlparse/filters/reindent.py:30` — repeated flattening from the statement start
– `sqlparse/filters/reindent.py:44` — prefix joining for offset calculation
– `sqlparse/filters/reindent.py:216` — tuple-list processing path
A complete validated proof of concept is available. The reproduction compares two same-shape tuple-list inputs formatted with reindentation enabled. The 600-tuple baseline completed in 0.649 seconds, while the below-cap 1,425-tuple input completed in 4.999 seconds. The verification helper formats two same-shape payloads with `reindent=True` and fails unless the larger payload takes at least 2.0 seconds and at least 4x the baseline.
No reproduction blocker was recorded. Timing varies by host, and exploitation requires the reindentation option or corresponding CLI mode to be enabled.
DailyCVE Form:
Platform: python-sqlparse
Version: < 0.6.0
Vulnerability: CPU DoS
Severity: Medium (5.1)
date: 2026-09-01
Prediction: 2026-09-01 (fixed)
What Undercode Say:
Analytics show that applications using `sqlparse.format(sql, reindent=True)` on user-supplied SQL are at risk. The following commands and code snippets are relevant:
Check sqlparse version pip show sqlparse | grep Version Upgrade to patched version pip install --upgrade sqlparse>=0.6.0
Vulnerable usage import sqlparse sql = "(1, 2, 3), " 1425 Crafted payload formatted = sqlparse.format(sql, reindent=True) Triggers CPU exhaustion
Exploit: (Educational Purposes!)
An attacker can craft a SQL query containing a parenthesized tuple list with approximately 1,425 tuples (just below the `MAX_GROUPING_TOKENS` cap). When this payload is passed to `sqlparse.format()` with reindent=True, the `ReindentFilter` performs thousands of offset calculations, each traversing an expanding token tree from the statement start. This results in quadratic CPU consumption, with the 1,425-tuple input taking nearly 5 seconds to process versus 0.6 seconds for a 600-tuple baseline.
Protection:
Upgrade to sqlparse version 0.6.0 or later, which contains the fix for this vulnerability. If immediate upgrade is not possible, avoid using the `reindent=True` option on untrusted SQL input. Applications that do not enable reindentation are not affected.
Impact:
This is a CPU resource-exhaustion vulnerability in workflows that reindent attacker-controlled SQL. A small crafted tuple-list input can occupy a worker for several seconds, enabling request delays, reduced throughput, or worker starvation when payloads are processed repeatedly or concurrently. The affected reindentation behavior is opt-in, and sqlparse itself does not provide network exposure; reachability depends on the consuming application or CLI workflow. The demonstrated effect is CPU consumption in a single formatting call, not process termination, code execution, or confidentiality or integrity impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
