CVE-2024-4340

nvd nist nuclei

Published: Apr 30, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: reefs@jfrog.com (Secondary)

Description

Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (7)

https://github.com/advisories/GHSA-2m57-hf25-phgg

Source: reefs@jfrog.com

https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03

Source: reefs@jfrog.com

https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/

Source: reefs@jfrog.com

https://github.com/advisories/GHSA-2m57-hf25-phgg

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/andialbrecht/sqlparse/commit/b4a39d9850969b4e1d6940d32094ee0b42a2cf03

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://research.jfrog.com/vulnerabilities/sqlparse-stack-exhaustion-dos-jfsa-2024-001031292/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.