PyPI/sqlparse CVE-2023-30608: medium 5.5, EPSS 0.98%

sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service

Action: Upgrade sqlparse to 0.4.4 or later.

pip install sqlparse==0.4.4

Affected

Fixed versions

Sources

• osv: GHSA-rrm6-wvj7-cwh2
• https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
• https://nvd.nist.gov/vuln/detail/CVE-2023-30608
• https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
• https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a
• https://github.com/andialbrecht/sqlparse
• https://github.com/pypa/advisory-database/tree/main/vulns/sqlparse/PYSEC-2023-87.yaml
• https://lists.debian.org/debian-lts-announce/2023/05/msg00017.html
• https://lists.debian.org/debian-lts-announce/2024/12/msg00022.html
• https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

CVE-2023-30608 · published 2023-04-21T20:24:21Z · modified 2025-11-04T17:36:56.468880Z · JSON