GitHub Advisoryadvisory · PyPI

GHSA-27jp-wm6q-gp25 sqlparse: formatting list of tuples leads to denial of service

MEDIUM Published 2026-02-13 Modified 2026-02-13 Official page ↗

Ecosystem: PyPI
Packages: sqlparse
Severity: Moderate
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses: CWE-770
Reviewed: 2026-02-13

Affected packages

• PyPI sqlparse: < 0.5.4 → fixed in 0.5.4

Description

Summary The below gist hangs while attempting to format a long list of tuples. This was found while drafting a regression test for Dja ngo 5.2's composite primary key feature, which allows querying composite fields with tuples.

Related

Weakness · CWE (1)

CWE-770 Allocation of Resources Without Limits or Throttling weakness

References