Read the docs
TI-2023-14424 Aliases CVE-2023-30608GHSA-rrm6-wvj7-cwh2

Parser contains an inefficient regular expression in sqlparse

Priority LOW 35CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.

Summary

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0098 62nd percentileScored 2026-11-07
Fix Partial sqlparse (andialbrecht): 0.4.4sqlparse (PyPI): 0.4.4Red Hat: 2 advisoriesRed Hat: 2 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
andialbrechtsqlparse0.1.15 to before 0.4.40.4.4Patch availableCNA
—sqlparse (PyPI)0.1.15 to before 0.4.40.4.4Patch availableGHSA-rrm6-wvj7-cwh2
  • sqlparse Vendorandialbrecht Affected 0.1.15 to before 0.4.4 Fixed in 0.4.4 Patch available CNA
  • sqlparse (PyPI) Vendor— Affected 0.1.15 to before 0.4.4 Fixed in 0.4.4 Patch available GHSA-rrm6-wvj7-cwh2

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:python:*:*0.1.15 to before 0.4.4VulnerableSqlparse Project
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:python:*:* Versions 0.1.15 to before 0.4.4 Vulnerable ·Sqlparse Project
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA sqlparse (andialbrecht) Fixed in 0.4.4
  • Fix · GHSA-rrm6-wvj7-cwh2 sqlparse (PyPI) Fixed in 0.4.4 Advisory →

Red Hat 2 advisories

  • RHSA-2023:6818 Released 2023-11-08 · Red Hat rating Important
    Satellite 6.14 security and bug fix update
    • Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
  • RHSA-2023:4591 Released 2023-08-09 · Red Hat rating Moderate
    RHUI 4.5.0 release - Security, Bug Fixes, and Enhancements
    • RHUI 4 for RHEL 8 python-django-3.2.19-1.0.1.el8ui, python-sqlparse-0.4.4-1.0.1.el8ui, python39-django-3.2.19-1.0.1.el8ui +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 16.1AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 17.0AffectedNo fix planned: Out of support scope
RHUI 4 for RHEL 8Fixed RHSA-2023:4591
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2023:6818
Not affected: 2 products
  • RHUI 4 for RHEL 8
  • Red Hat Satellite 6.14 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30608
  2. 2026-10-03 Alias added: GHSA-rrm6-wvj7-cwh2

References

Patch 3

Advisory 2

Other 4

  • TI-2026-39184 sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger CVSS 4.0HIGH 8.7
  • TI-2026-42707 sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) CVSS 3.1HIGH 7.5
  • TI-2026-57940 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption CVSS 4.0MEDIUM 5.1
  • TI-2026-50099 sqlparse: Quadratic O(n²) DoS in group_comments CVSS 4.0HIGH 8.7
  • TI-2026-76501 PHP code injection in sqlparse via output_format='php' CVSS 4.0HIGH 8.4
  • TI-2026-42708 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes CVSS 4.0MEDIUM 6.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences