CVE-2024-4340

Name of the Vulnerable Software and Affected Versions sqlparse (affected versions not specified)

Description The issue is related to the sqlparse.parse() function, which can lead to a Denial of Service due to a RecursionError when processing a heavily nested list. This can be exploited by a remote attacker to cause a denial of service. The impact depends on the use of the sqlparse.parse() function, and anyone parsing user input with this function is affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider limiting the recursion depth in the flatten() function of the TokenList class to prevent excessive recursion. For example, you can modify the function to raise an error when a maximum depth is reached.