sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree, producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql,
    reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through
    ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly
    rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree,
    producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request
    delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0. (CVE-2026-84305)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4145-1 advisory.

    This update for python-sqlparse fixes the following issue:

    - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4109-1 advisory.

    This update for python-sqlparse fixes the following issue:

    - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21777-1 advisory.

    This update for python-sqlparse fixes the following issue:

    - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption (bsc#1278097).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql,     reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through     ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_token() repeatedly     rebuilds and joins the statement prefix. Thousands of offset calculations walk an expanding token tree,     producing quadratic CPU consumption for inputs that remain below MAX_GROUPING_TOKENS and causing request     delays, reduced throughput, or worker starvation. This issue is fixed in version 0.6.0. (CVE-2026-84305)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459136	Echo: sqlparse: security update to 0.6.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459136	Echo: sqlparse: security update to 0.6.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
346227	SUSE SLED15 / SLES15 Security Update : python-sqlparse (SUSE-SU-2026:4145-1)	Nessus	SuSE Local Security Checks	Local	medium
345843	SUSE SLES15 Security Update : python-sqlparse (SUSE-SU-2026:4109-1)	Nessus	SuSE Local Security Checks	Local	medium
343946	openSUSE 16 Security Update : python-sqlparse (openSUSE-SU-2026:21777-1)	Nessus	SuSE Local Security Checks	Local	medium
342332	Linux Distros Unpatched Vulnerability : CVE-2026-84305	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-84305

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium