{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/sqlparse/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-54284"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sqlparse (\u003c= 0.5.5)"],"_cs_severities":["medium"],"_cs_tags":["dos","algorithmic-complexity","sqlparse","cve-2026-54284","denial-of-service","vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Python library \u003ccode\u003esqlparse\u003c/code\u003e (version 0.5.5 and earlier) is vulnerable to an algorithmic complexity denial-of-service (DoS) attack. The vulnerability exists within \u003ccode\u003eTokenList.__init__\u003c/code\u003e, which performs an eager, recursive flattening of the SQL subtree (via \u003ccode\u003estr(self)\u003c/code\u003e) during the construction of every token group.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003esqlparse\u003c/code\u003e processes input containing deeply nested structures such as parentheses, \u003ccode\u003eCASE WHEN\u003c/code\u003e chains, or nested subqueries, the parser performs work proportional to \u003ccode\u003eO(n*d)\u003c/code\u003e (where \u003ccode\u003en\u003c/code\u003e is the number of tokens and \u003ccode\u003ed\u003c/code\u003e is the nesting depth). This results in a massive CPU amplification - approximately 5000x for a ~2 KB payload - that consumes significant CPU time before reaching the library's built-in depth and token caps. An attacker can exhaust worker pools in multi-threaded web applications or lock up single-threaded services by sending a small number of these crafted malicious SQL payloads. The issue affects any consumer of \u003ccode\u003esqlparse\u003c/code\u003e that exposes the parser to unauthenticated user input, including formatters, debug toolbars, and metadata analysis tools.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application utilizing \u003ccode\u003esqlparse\u003c/code\u003e to process user-supplied SQL queries (e.g., SQL formatters or database debug interfaces).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious 1-2 KB SQL payload containing high levels of nesting, such as \u003ccode\u003eSELECT (((((...)))))\u003c/code\u003e (2000+ levels) or deeply nested \u003ccode\u003eCASE WHEN\u003c/code\u003e branches.\u003c/li\u003e\n\u003cli\u003eAttacker sends multiple parallel HTTP POST requests containing the crafted payload to the vulnerable endpoint.\u003c/li\u003e\n\u003cli\u003eThe application triggers \u003ccode\u003esqlparse.parse()\u003c/code\u003e or \u003ccode\u003esqlparse.format()\u003c/code\u003e upon receiving the input.\u003c/li\u003e\n\u003cli\u003eThe library's \u003ccode\u003eTokenList.__init__\u003c/code\u003e is invoked recursively during grouping, triggering the \u003ccode\u003eO(n*d)\u003c/code\u003e flattening logic.\u003c/li\u003e\n\u003cli\u003eThe system enters a high-CPU state while performing recursive flattening, effectively locking the worker process.\u003c/li\u003e\n\u003cli\u003eThe application worker remains unresponsive for seconds to tens of seconds per request.\u003c/li\u003e\n\u003cli\u003eConcurrent requests exhaust the available worker pool, resulting in a denial-of-service condition for legitimate users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to resource exhaustion and service unavailability. Observations indicate that a single 2 KB payload can pin a CPU worker at 100% utilization for approximately 10 seconds. In environments with a limited worker pool, a small number of concurrent requests can result in total service outage. Downstream libraries, such as \u003ccode\u003esql-metadata\u003c/code\u003e, also inherit this vulnerability, extending the impact to any tool using \u003ccode\u003esqlparse\u003c/code\u003e for internal query analysis.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately upgrade \u003ccode\u003esqlparse\u003c/code\u003e to a version that implements the patch described in the advisory (replacing eager \u003ccode\u003estr(self)\u003c/code\u003e materialization with concatenation of cached values).\u003c/li\u003e\n\u003cli\u003eImplement request-size limits and payload-structure complexity heuristics at the WAF or reverse proxy level to detect and drop highly nested SQL patterns before they reach the application.\u003c/li\u003e\n\u003cli\u003eEnsure application-level timeouts are configured for all database-related processing functions to prevent worker-pool starvation from slow-running parser tasks.\u003c/li\u003e\n\u003cli\u003eReview internal usage of \u003ccode\u003esqlparse\u003c/code\u003e in debug toolbars or log formatters to ensure untrusted user input is not passed directly to library entry points without sanitization or strict depth validation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-17T18:46:40Z","date_published":"2026-08-17T18:46:25Z","id":"https://feed.craftedsignal.io/briefs/2026-08-sqlparse-dos/","summary":"A complexity vulnerability in sqlparse \u003c= 0.5.5 allows attackers to trigger CPU exhaustion through deeply nested SQL structures, achieving significant amplification and causing denial of service in downstream applications.","title":"SQLParse CPU Denial of Service via Algorithmic Complexity","url":"https://feed.craftedsignal.io/briefs/2026-08-sqlparse-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Sqlparse","version":"https://jsonfeed.org/version/1.1"}