CVE-2024-4340

What it actually does

This vulnerability is a denial-of-service condition in the Python sqlparse library. When sqlparse.parse() receives an attacker-controlled, heavily nested Python list instead of a normal SQL string, the parser can recurse until Python raises a RecursionError. In applications that expose sqlparse parsing to remote users, this can cause request failures, worker crashes, error storms, or resource exhaustion. The flaw does not directly provide code execution, data disclosure, or data modification; the primary impact is loss of availability.

Why it matters to the business

Applications or services that use sqlparse on untrusted input may become unreliable or unavailable when malformed, deeply nested input is submitted. This can interrupt user-facing functionality, degrade API reliability, trigger autoscaling or operational incidents, and create support load. The issue has a high availability impact but is not currently listed in CISA KEV and has no known public exploit maturity in the provided data, so remediation should be prioritized based on whether sqlparse is reachable through externally supplied input.

How an attack unfolds

An attacker first identifies an application feature, API endpoint, job processor, query formatter, validation routine, or developer tool that passes user-controlled content into sqlparse.parse(). Instead of sending ordinary SQL text, the attacker submits an extremely deeply nested list-like structure through a path that the application converts or forwards into Python objects. When the vulnerable sqlparse version attempts to parse the structure, recursive processing exceeds Python's recursion limit and raises RecursionError. If the application does not isolate or reject the bad input, the request may fail with a 500 error, the worker may terminate or restart, and repeated submissions can exhaust available workers or keep the affected service in a degraded state.

How to fix it

Upgrade sqlparse to a fixed version or a package build that includes commit b4a39d9850969b4e1d6940d32094ee0b42a2cf03. If consuming directly from Git, pin to that commit or a later trusted commit. If consuming through PyPI, Linux distributions, container images, or vendored dependencies, update to the vendor release that incorporates this fix and rebuild/redeploy dependent applications. As defense in depth, ensure calls to sqlparse.parse() only receive expected string input, reject lists and deeply nested structured objects before parsing, enforce request size and nesting-depth limits at API boundaries, wrap parsing in exception handling that safely returns an error without crashing workers, and apply rate limiting to endpoints that trigger parsing.

How to confirm the fix worked

Confirm dependency inventories, lockfiles, SBOMs, container images, and runtime environments no longer include a vulnerable sqlparse build and that the installed code contains the fix at or after commit b4a39d9850969b4e1d6940d32094ee0b42a2cf03. Run unit or integration tests that pass normal SQL strings to sqlparse.parse() and verify expected behavior. Add a negative regression test using an intentionally nested list-like input and confirm the application rejects it before parsing or handles the resulting exception without worker termination or service degradation. Validate externally exposed endpoints enforce input type, size, and nesting limits and return controlled 4xx responses for malformed input rather than 500 errors or process crashes.

Typical attack path

1. Find an exposed application feature or API that accepts user-supplied SQL-like input, query text, filters, or structured payloads that may be parsed by sqlparse.
2. Submit a malformed payload containing a heavily nested list or list-like structure rather than a normal SQL string.
3. Trigger sqlparse.parse() in the vulnerable application code path.
4. Cause Python recursion depth exhaustion and a RecursionError inside the parser.
5. Repeat requests to produce sustained request failures, worker restarts, queue backlog, or service unavailability.

How to detect it

Look for evidence of application-level denial-of-service attempts rather than host compromise. Relevant sources include application logs, Python exception traces, web/API gateway logs, WAF logs, process supervisor logs, container restart events, APM traces, and metrics for 5xx spikes or worker restarts. Search for RecursionError exceptions occurring in code paths that call sqlparse.parse() or reference the sqlparse package. Correlate these errors with requests containing unusually large bodies, excessive nested brackets or arrays, repeated malformed JSON/list payloads, or bursts from the same source IP or client identity. Investigate periods where parsing-related errors align with increased latency, queue buildup, gunicorn/uWSGI/Celery worker restarts, Kubernetes pod restarts, or sudden drops in successful request volume. There are no known malware artifacts or network command-and-control indicators associated with this vulnerability; detection should focus on malformed input attempts and resulting Python recursion failures.

• RecursionError: maximum recursion depth exceeded
• maximum recursion depth exceeded while calling a Python object
• /site-packages/sqlparse/
• sqlparse.parse(
• sqlparse.exceptions
• Traceback (most recent call last):
• Worker exiting
• worker timeout
• container restarted
• CrashLoopBackOff

What your security team should do

• Inventory applications, containers, serverless functions, CI tools, and developer portals that include the Python sqlparse library.
• Prioritize remediation for internet-facing or multi-tenant services where user-controlled input can reach sqlparse.parse().
• Upgrade or repin sqlparse to a build containing commit b4a39d9850969b4e1d6940d32094ee0b42a2cf03 or later.
• Add application-layer validation to require SQL parser inputs to be strings and to reject deeply nested structured payloads.
• Review error handling around SQL parsing so malformed input cannot crash worker processes or create unbounded retries.
• Add monitoring for RecursionError events, elevated 5xx rates, worker restarts, and unusual request bodies with excessive nesting.
• If immediate upgrade is not possible, restrict access to affected parsing functionality, apply rate limits, and block requests with excessive bracket or array nesting at API gateways or WAFs.