sqlparse parsing heavily nested list leads to Denial of Service

🗓️ 07 Jul 2026 11:45:38Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 5 Views

Heavily nested lists cause sqlparse.parse to trigger a RecursionError, risking Denial of Service.

Reporter	Title	Published	Views	Family All 79
ibm	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to sqlparse-0.4.4-py3-none-any.whl CVE-2024-4340	28 Jan 202522:08	–	ibm
ibm	Security Bulletin: Vulnerability in sqlparse affects IBM Process Mining CVE-2024-4340	28 Jun 202415:17	–	ibm
ibm	Security Bulletin: Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.	27 Sep 202503:16	–	ibm
ibm	Security Bulletin: sqlparse Vulnerability Affects IBM Data Observability by Databand Self-Hosted (CVE-2024-4340)	28 Jan 202522:08	–	ibm
bdu_fstec	The vulnerability of the sqlparse.parse() function in the SQL parser module for Python, Sqlparse, allows a hacker to cause a service failure.	3 Feb 202500:00	–	bdu_fstec
cgr	CVE-2024-4340 vulnerabilities	30 Apr 202415:15	–	cgr
circl	CVE-2024-4340	15 Apr 202420:21	–	circl
cnnvd	sqlparse 安全漏洞	30 Apr 202400:00	–	cnnvd
cve	CVE-2024-4340	30 Apr 202414:23	–	cve
cvelist	CVE-2024-4340 Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.	30 Apr 202414:23	–	cvelist

Vulners

Node

pypi sqlparseRange0–0.5.0

Source	Link
github	www.github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-4340
github	www.github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
github	www.github.com/andialbrecht/sqlparse
research	www.research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292
pypi	www.pypi.org/project/sqlparse
github	www.github.com/advisories/GHSA-2m57-hf25-phgg

07 Jul 2026 17:25Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

EPSS0.0321

SSVC