JFrog Security Research
< Back

JFSA-2024-001031292 - sqlparse stack exhaustion DoS

CVE-2024-4340 | CVSS 7.5

JFrog Severity:high

Discovered ByUriya Yavnieliof the JFrog Security Research Team

Published 30 Apr, 2024 | Last updated 30 Apr, 2024

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

sqlparse

(,0.5.0)

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

Running the following code will raise Maximum recursion limit exceeded exception:

import sqlparse
sqlparse.parse('[' * 10000 + ']' * 10000)

No mitigations are supplied for this issue

Fix commit

GHSA Advisory

< Back