THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-cfqr-cjx5-5jcm (medium) — sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

[GHSA] GHSA-cfqr-cjx5-5jcm (medium) — sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

medgithub_advisoriesPublished 2026-09-01

GHSA-cfqr-cjx5-5jcm Severity: medium CVE: CVE-2026-84305

sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

### Summary

When SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple

Indicators of compromise

CVE-2026-84305cve

Original source: https://github.com/advisories/GHSA-cfqr-cjx5-5jcm