CVE-2021-32839

Name of the Vulnerable Software and Affected Versions sqlparse versions 0.4.0 through 0.4.1

Description The issue is related to a regular Expression Denial of Service in the sqlparse module for Python. The regular expression may cause exponential backtracking on strings containing many repetitions of r in SQL comments. This affects the formatting feature that removes comments from SQL statements.

Recommendations For sqlparse versions 0.4.0 and 0.4.1, as a workaround, do not use the sqlformat.format function with keyword strip comments=True or the --strip-comments command line flag when using the sqlformat command line tool. For sqlparse versions 0.4.0 and 0.4.1, update to sqlparse 0.4.2 to fix the issue.