GHSA-27jp-wm6q-gp25 sqlparse: formatting list of tuples leads to denial of service
An attacker can cause a denial of service by providing a long list of tuples to the sqlparse library for formatting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-27jp-wm6q-gp25?
GHSA-27jp-wm6q-gp25 is a denial of service vulnerability in sqlparse, published on 13 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
The below gist hangs while attempting to format a long list of tuples.
This was found while drafting a regression test for Dja ngo 5.2's composite primary key feature, which allows querying composite fields with tuples.
Which versions are affected by GHSA-27jp-wm6q-gp25?
2 open source packages ship an affected version, including sqlparse.
| Package | Affected | Fixed in |
|---|---|---|
sqlparse PyPI | All versions | 0.5.4 |
sqlparse PyPI | All versions | 0.5.4 |
How do I fix GHSA-27jp-wm6q-gp25?
Upgrade sqlparse to 0.5.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-27jp-wm6q-gp25 being exploited?
There is no known exploitation of GHSA-27jp-wm6q-gp25 in the wild and no public exploit code.