CVE-2026-54284

sqlparse versions before 0.6.0 have a CPU DoS flaw: TokenList.__init__ calls str(self), which recursively flattens the entire subtree on every group construction, producing O(n*d) cost. A ~2 KB deeply-nested SQL payload pins a worker for ~10 seconds (~5000x amplification). Flask-based SQL formatt...