https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:13:48 +0000 https://cve.radiocsirt.org/vuln/brew-athenacli-cve-2026-84305 <p><strong>Affected:</strong> Homebrew: athenacli</p> <p>### Summary</p> <p>When SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-token cap. Thousands of offset calculations then traverse an expanding token tree, causing multi-second CPU consumption from an input of roughly 16 KB and degrading service availability.</p> <p>### Details</p> <p>`ReindentFilter._get_offset()` joins the tokens returned by `_flatten_up_to_token()` to calculate the current output position. Each call begins by flattening the current statement from its start and walks until the target token. Tuple-list reindentation invokes this calculation repeatedly as it processes many parenthesized values, so later calls redo an increasingly large amount of prior work.</p> <p>The vulnerable path is reached through `sqlparse.format(sql, reindent=True)` and `sqlformat --reindent`. A carefully sized tuple list completes grouping below the configured token cap and then enters the expensive reindentation path; a slightly larger input may instead be rejected quickly by the cap.</p> <p>Relevant code locations:</p> <p>- `sqlparse/formatter.py:170` — enabling `ReindentFilter` - `sqlparse/filters/reindent.py:30` — repeated flattening from the statement start - `sqlparse/filters/reindent.py:44` — prefix joining for offset calculation - `sqlparse/filters/reindent.py:216` — tuple-list pr…</p> <p><strong>Affected:</strong> Homebrew: athenacli</p> <p>### Summary</p> <p>When SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-token cap. Thousands of offset calculations then traverse an expanding token tree, causing multi-second CPU consumption from an input of roughly 16 KB and degrading service availability.</p> <p>### Details</p> <p>`ReindentFilter._get_offset()` joins the tokens returned by `_flatten_up_to_token()` to calculate the current output position. Each call begins by flattening the current statement from its start and walks until the target token. Tuple-list reindentation invokes this calculation repeatedly as it processes many parenthesized values, so later calls redo an increasingly large amount of prior work.</p> <p>The vulnerable path is reached through `sqlparse.format(sql, reindent=True)` and `sqlformat --reindent`. A carefully sized tuple list completes grouping below the configured token cap and then enters the expensive reindentation path; a slightly larger input may instead be rejected quickly by the cap.</p> <p>Relevant code locations:</p> <p>- `sqlparse/formatter.py:170` — enabling `ReindentFilter` - `sqlparse/filters/reindent.py:30` — repeated flattening from the statement start - `sqlparse/filters/reindent.py:44` — prefix joining for offset calculation - `sqlparse/filters/reindent.py:216` — tuple-list pr…</p> https://cve.radiocsirt.org/vuln/brew-athenacli-cve-2026-84305 https://cve.radiocsirt.org/vuln/cve-2026-84305 <p><strong>Affected:</strong> andialbrecht sqlparse</p> <p>sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.</p> <p><strong>Affected:</strong> andialbrecht sqlparse</p> <p>sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-84305 https://cve.radiocsirt.org/vuln/ghsa-cfqr-cjx5-5jcm <p><strong>Affected:</strong> PyPI: sqlparse</p> <p>### Summary</p> <p>When SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-token cap. Thousands of offset calculations then traverse an expanding token tree, causing multi-second CPU consumption from an input of roughly 16 KB and degrading service availability.</p> <p>### Details</p> <p>`ReindentFilter._get_offset()` joins the tokens returned by `_flatten_up_to_token()` to calculate the current output position. Each call begins by flattening the current statement from its start and walks until the target token. Tuple-list reindentation invokes this calculation repeatedly as it processes many parenthesized values, so later calls redo an increasingly large amount of prior work.</p> <p>The vulnerable path is reached through `sqlparse.format(sql, reindent=True)` and `sqlformat --reindent`. A carefully sized tuple list completes grouping below the configured token cap and then enters the expensive reindentation path; a slightly larger input may instead be rejected quickly by the cap.</p> <p>Relevant code locations:</p> <p>- `sqlparse/formatter.py:170` — enabling `ReindentFilter` - `sqlparse/filters/reindent.py:30` — repeated flattening from the statement start - `sqlparse/filters/reindent.py:44` — prefix joining for offset calculation - `sqlparse/filters/reindent.py:216` — tuple-list pr…</p> <p><strong>Affected:</strong> PyPI: sqlparse</p> <p>### Summary</p> <p>When SQL is formatted with reindentation enabled, `ReindentFilter` repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker who controls SQL sent to this opt-in formatting path can supply a parenthesized tuple list that remains just below the grouping-token cap. Thousands of offset calculations then traverse an expanding token tree, causing multi-second CPU consumption from an input of roughly 16 KB and degrading service availability.</p> <p>### Details</p> <p>`ReindentFilter._get_offset()` joins the tokens returned by `_flatten_up_to_token()` to calculate the current output position. Each call begins by flattening the current statement from its start and walks until the target token. Tuple-list reindentation invokes this calculation repeatedly as it processes many parenthesized values, so later calls redo an increasingly large amount of prior work.</p> <p>The vulnerable path is reached through `sqlparse.format(sql, reindent=True)` and `sqlformat --reindent`. A carefully sized tuple list completes grouping below the configured token cap and then enters the expensive reindentation path; a slightly larger input may instead be rejected quickly by the cap.</p> <p>Relevant code locations:</p> <p>- `sqlparse/formatter.py:170` — enabling `ReindentFilter` - `sqlparse/filters/reindent.py:30` — repeated flattening from the statement start - `sqlparse/filters/reindent.py:44` — prefix joining for offset calculation - `sqlparse/filters/reindent.py:216` — tuple-list pr…</p> https://cve.radiocsirt.org/vuln/ghsa-cfqr-cjx5-5jcm