GHSA-2m57-hf25-phgg: sqlparse parsing heavily nested list leads to Denial of Service

April 15, 2024

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

References

github.com/advisories/GHSA-2m57-hf25-phgg
github.com/andialbrecht/sqlparse
github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03
github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg

Detect and mitigate GHSA-2m57-hf25-phgg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →