THREAT OPS › Threat News › [GHSA] GHSA-pwgv-4x5q-6m9f (high) — sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
[GHSA] GHSA-pwgv-4x5q-6m9f (high) — sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
GHSA-pwgv-4x5q-6m9f Severity: high CVE: CVE-2026-54284
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
### Summary
`sqlparse` ships hard limits (`MAX_GROUPING_DEPTH=100`, `MAX_GROUPING_TOKENS=10000`) intended to bound parsing work on attacker-supplied SQL, but the path that *reaches* those limits is itself `O(n*depth)` per to
MITRE ATT&CK techniques
- Web ServiceT1102
Indicators of compromise
- c923da9c5a8e8403dd32efc2171b60a177444d43sha1
- CVE-2026-54284cve
- sqlformat.orgdomain
Original source: https://github.com/advisories/GHSA-pwgv-4x5q-6m9f