GHSA-f2ff-p2ww-7p4p

Опубликовано: 17 авг. 2026

Источник: github

Github: Прошло ревью

CVSS4: 8.7

Описание

sqlparse: Quadratic O(n²) DoS in group_comments

Summary

A comment-only statement (-- c\n*n) may cause a Denial of Service (DoS).

Details

Location: sqlparse/engine/grouping.py:331-341 (group_comments), invoked first in group() at grouping.py:439. Reachable via sqlparse.parse() and sqlparse.format(sql, strip_comments=True).

A statement made of many single-line comments ('-- c\n' repeated) lexes in O(n) but group_comments is O(n²):

def group_comments(tlist): tidx, token = tlist.token_next_by(t=T.Comment) while token: eidx, end = tlist.token_not_matching( lambda tk: imt(tk, t=T.Comment) or tk.is_newline, idx=tidx) ... tidx, token = tlist.token_next_by(t=T.Comment, idx=tidx)

The while loop runs n times and each token_next_by / token_not_matching rescans the O(n) remaining tokens. When all tokens are comments/newlines nothing ever groups, yet the full scan is repeated per token.

Two following factors increase the severity:

group_comments runs first in group() (grouping.py:439), before the _group_matching token-count guard (grouping.py:34-39). So the entire quadratic cost is paid even on oversized input. MAX_GROUPING_TOKENS does not provide protection on this vector.
It sits on the primary sanitizer path: format(sql, strip_comments=True), used by query loggers, SQL firewalls, ORMs, and migration tools.

PoC

Tested using Python 3.14:

import time, sqlparse for n in (1000, 2000, 4000): s = "-- c\n" * n t = time.perf_counter() sqlparse.format(s, strip_comments=True) print(f"n={n:5d} format(strip_comments)={1000*(time.perf_counter()-t):7.1f} ms")

Output:

n= 1000 format(strip_comments)= 106.0 ms n= 2000 format(strip_comments)= 403.3 ms n= 4000 format(strip_comments)= 1602.8 ms

Time increase of ~4× per 2× input (quadratic). parse() shows the identical curve. Instrumented scan counts are exactly 1.0M / 4.0M / 16.0M tokens for n=1000/2000/4000. A ~250 KB comment-only payload forces minutes of CPU regardless of the 10000 token cap.

Impact

Denial of Service

Ссылки

Пакеты

Наименование

sqlparse

pip

Затронутые версииВерсия исправления

<= 0.5.5

0.6.0

EPSS

Процентиль: 18%

0.00263

Низкий

8.7 High

CVSS4

CVE ID

CVE-2026-71491

Дефекты

CWE-400

CWE-407

Связанные уязвимости

CVE-2026-71491

ubuntu

14 дней назад

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.