CVE-2026-84305

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0

Description An issue exists when SQL is formatted with reindentation enabled, where the ReindentFilter repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker providing a crafted parenthesized tuple list can trigger thousands of offset calculations that traverse an expanding token tree. This results in quadratic CPU consumption, leading to request delays, reduced throughput, or worker starvation. The issue is triggered via the sqlparse.format(sql, reindent=True) function and the sqlformat --reindent command, specifically within the ReindentFilter. get offset() function and the flatten up to token() process in sqlparse/filters/reindent.py.

Recommendations Update sqlparse to version 0.6.0. As a temporary workaround, avoid using the reindent=True parameter in the sqlparse.format() function or the --reindent option in the sqlformat command when processing attacker-controlled input.