DEBIAN-CVE-2026-84305

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...