What’s Vulnerable › Vulnerabilities
CVE-2024-4340: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-04-30 · updated 2026-06-17
- Weakness: CWE-674
Description
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
Affected products
- andialbrecht sqlparse: 0
- Pypi Sqlparse: before 0.5.0; 0.1.0, 0.1.1, 0.1.10, 0.1.11, 0.1.12, 0.1.13 (+26) — fixed in 0.5.0
How to fix
Upgrade to a fixed version: Pypi Sqlparse 0.5.0. Check the vendor advisory for mitigations.
References
- https://github.com/advisories/GHSA-2m57-hf25-phgg
- https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
- https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/
- https://github.com/advisories/GHSA-2m57-hf25-phgg
- https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
- https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html
- https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/
Get alerted when CVE-2024-4340 or the next vulnerability affects your stack