Parser contains an inefficient regular expression in sqlparse

CVE-2023-30608

What is CVE-2023-30608?

The sqlparse module, a non-validating SQL parser for Python, is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability. This issue stems from a flawed regular expression introduced in an earlier commit, which can be exploited to disrupt the availability of applications utilizing this parser. The vulnerability has been addressed in version 0.4.4 of sqlparse, where the problematic regex has been removed. Users are strongly advised to upgrade to this version to mitigate potential threats. There are currently no known workarounds, highlighting the urgency of updating to safeguard against possible denial of service attacks.

References