Regular Expression Denial of Service in sqlparse
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments. Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the sqlformat.format function with keyword strip_comments=True or the --strip-comments command line flag when using the sqlformat command line tool. The issues has been fixed in sqlparse 0.4.2.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| andialbrecht | sqlparse | 0.4.0 to before 0.4.2 | 0.4.2 | Patch available | CNA |
| — | sqlparse (PyPI) | 0.4.0 to before 0.4.2 | 0.4.2 | Patch available | GHSA-p5w8-wqhj-9hhf |
- sqlparse Vendorandialbrecht Affected 0.4.0 to before 0.4.2 Fixed in 0.4.2 Patch available CNA
- sqlparse (PyPI) Vendor— Affected 0.4.0 to before 0.4.2 Fixed in 0.4.2 Patch available GHSA-p5w8-wqhj-9hhf
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:*:*:* | 0.4.0 to before 0.4.2 | Vulnerable | Sqlparse Project |
- cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:*:*:* Versions 0.4.0 to before 0.4.2 Vulnerable ·Sqlparse Project
Remediation
- Fix · CNA sqlparse (andialbrecht) Fixed in 0.4.2
- Fix · GHSA-p5w8-wqhj-9hhf sqlparse (PyPI) Fixed in 0.4.2 Advisory →
Red Hat 1 advisory
- RHSA-2022:5498 Released 2022-07-05 · Red Hat rating ModerateSatellite 6.11 Release
- Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.13-1.el7sat, foreman-3.1.1.21-2.el7sat, libsolv-0.7.22-1.el7pc +4
- Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.13-1.el8sat, foreman-3.1.1.21-2.el8sat, libsolv-0.7.22-1.el8pc +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat Ansible Tower 3 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat Satellite 6.11 for RHEL 8 | Fixed | RHSA-2022:5498 |
Not affected: 4 products
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat Satellite 6.11 for RHEL 7
- Red Hat Satellite 6.11 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2021-32839
- 2026-10-03 Alias added: GHSA-p5w8-wqhj-9hhf
References
Advisory 3
More andialbrecht vulnerabilities
- TI-2026-39184 sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger CVSS 4.0HIGH 8.7
- TI-2026-42707 sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) CVSS 3.1HIGH 7.5
- TI-2026-57940 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption CVSS 4.0MEDIUM 5.1
- TI-2026-50099 sqlparse: Quadratic O(n²) DoS in group_comments CVSS 4.0HIGH 8.7
- TI-2026-76501 PHP code injection in sqlparse via output_format='php' CVSS 4.0HIGH 8.4
- TI-2026-42708 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes CVSS 4.0MEDIUM 6.2
Sources
- CVE-2021-32839 · CVE Program
- CVE-2021-32839 · NVD
- FIRST EPSS
- GHSA-p5w8-wqhj-9hhf · GitHub Advisory Database · CC BY 4.0
- CVE-2021-32839 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences