https://vulnerability.circl.lu/sightings/feed 2026-10-08T02:30:12.178196+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/0bd5f20d-7759-41fe-a843-551e58070cc9/export 2026-10-08T02:30:12.191420+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0bd5f20d-7759-41fe-a843-551e58070cc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-cfqr-cjx5-5jcm", "type": "seen", "source": "https://gist.github.com/alon710/342832b227e98d6656ed29633e96b4ab", "content": "# CVE-2026-84305: CVE-2026-84305: Algorithmic Complexity Vulnerability (ReindentFilter CPU Exhaustion) in sqlparse\n\n> **CVSS Score:** 5.1\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84305\n\n## Summary\nAn algorithmic complexity vulnerability in the python sqlparse library versions before 0.6.0 allows an attacker to cause high CPU usage and denial of service via a crafted SQL statement during formatting.\n\n## TL;DR\nThe sqlparse library contains an O(N^2) complexity flaw in its reindentation filter, allowing small crafted SQL payloads to trigger CPU exhaustion and denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407\n- **Attack Vector**: Local / Remote (via untrusted SQL input formatting)\n- **CVSS v4.0 Score**: 5.1\n- **Exploit Maturity**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- sqlparse (Python package)\n- **sqlparse**: < 0.6.0 (Fixed in: `0.6.0`)\n\n## Mitigation\n\n- Upgrade sqlparse to version 0.6.0 or newer.\n- Disable the opt-in 'reindent=True' formatting parameter when handling untrusted user input.\n\n**Remediation Steps:**\n1. Identify all Python environments running sqlparse versions older than 0.6.0.\n2. Execute 'pip install --upgrade sqlparse>=0.6.0' to upgrade the package.\n3. Audit application source code for instances of 'sqlparse.format(..., reindent=True)' and modify configuration if upgrading cannot be done immediately.\n\n## References\n\n- [GitHub Security Advisory GHSA-cfqr-cjx5-5jcm](https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm)\n- [Fix Commit a51df6d9e2d31b44be9adb6bc8732517db6bf96b](https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b)\n- [sqlparse 0.6.0 Release Notes](https://github.com/andialbrecht/sqlparse/releases/tag/0.6.0)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-84305)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-84305)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84305) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T06:32:30.247843Z"} 2026-09-02T06:32:30.247843+00:00