Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
Priority HIGH 72CWE-674Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.
Summary
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03237 88th percentileScored 2026-11-07
Fix Partial sqlparse: 0.5.0sqlparse (PyPI): 0.5.0Red Hat: 5 advisoriesRed Hat: 5 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | sqlparse | before 0.5.0 | 0.5.0 | Patch available | CNA |
| — | sqlparse (PyPI) | before 0.5.0 | 0.5.0 | Patch available | GHSA-2m57-hf25-phgg |
- sqlparse Vendor— Affected before 0.5.0 Fixed in 0.5.0 Patch available CNA
- sqlparse (PyPI) Vendor— Affected before 0.5.0 Fixed in 0.5.0 Patch available GHSA-2m57-hf25-phgg
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:*:*:* | — | — | Sqlparse Project |
- cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:*:*:* Versions — — ·Sqlparse Project
Remediation
- Fix · CNA sqlparse Fixed in 0.5.0
- Fix · GHSA-2m57-hf25-phgg sqlparse (PyPI) Fixed in 0.5.0 Advisory →
Red Hat 5 advisories
- RHSA-2025:9838 Released 2025-06-26 · Red Hat rating ModerateSatellite 6.15.5.3 Async Update
- Red Hat Satellite 6.15 for RHEL 8 cjson-1.7.18-1.el8sat, python-sqlparse-0.5.0-1.el8pc, python3.11-sqlparse-0.5.0-1.el8pc +1
- RHSA-2025:1335 Released 2025-02-12 · Red Hat rating ImportantRHUI 4.11 security, bugfix, and enhancement update
- RHUI 4 for RHEL 8 python-aiohttp-3.9.4-1.el8ui, python-cryptography-42.0.8-1.el8ui, python-django-4.2.15-1.el8ui +13
- RHSA-2024:9984 Released 2024-11-21 · Red Hat rating ModerateRHOSP 17.1.4 (python-sqlparse) security update
- Red Hat OpenStack Platform 17.1 python-sqlparse-0.4.1-2.el9ost, python3-sqlparse-0.4.1-2.el9ost
Show 2 more Red Hat advisories
- RHSA-2024:9986 Released 2024-11-21 · Red Hat rating ModerateRHOSP 17.1.4 (python-sqlparse) security update
- Red Hat OpenStack Platform 17.1 python-sqlparse-0.4.1-2.el8ost, python3-sqlparse-0.4.1-2.el8ost
- RHSA-2024:3781 Released 2024-06-10 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.7-1.el8ap, automation-hub-4.9.2-1.el8ap, python39-aiohttp-3.9.5-1.el8ap +25
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.7-1.el9ap, automation-hub-4.9.2-1.el9ap, python-aiohttp-3.9.5-1.el9ap +25
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| RHUI 4 for RHEL 8 | Fixed | RHSA-2025:1335 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:3781 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:3781 |
| Red Hat OpenStack Platform 17.1 | Fixed | RHSA-2024:9984, RHSA-2024:9986 |
| Red Hat Satellite 6.15 for RHEL 8 | Fixed | RHSA-2025:9838 |
Not affected: 6 products
- RHUI 4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat Satellite 6.15 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4340
- 2026-10-03 Alias added: GHSA-2m57-hf25-phgg
References
Advisory 2
Sources
- CVE-2024-4340 · CVE Program
- CVE-2024-4340 · NVD
- FIRST EPSS
- GHSA-2m57-hf25-phgg · GitHub Advisory Database · CC BY 4.0
- CVE-2024-4340 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences