Introduced through
django@3.2.25, django-storages@1.14.2 and others

Fixed in
sqlparse@0.5.0

Exploit maturity
PROOF OF CONCEPT

Detailed paths and remediation
Introduced through: project@0.0.0 › django@3.2.25 › sqlparse@0.4.4
Fix: Pin sqlparse to version 0.5.0
Introduced through: project@0.0.0 › django-storages@1.14.2 › django@3.2.25 › sqlparse@0.4.4
Fix: Pin sqlparse to version 0.5.0
Introduced through: project@0.0.0 › django-libsass@0.7 › django-compressor@4.4 › django-appconf@1.0.6 › django@3.2.25 › sqlparse@0.4.4

Fix: Pin sqlparse to version 0.5.0
Security information
Factors contributing to the scoring:
Snyk: CVSS 7.5 - High Severity

NVD: NVD only publishes analysis of vulnerabilities which are assigned a CVE ID. This vulnerability currently does not have an assigned CVE ID.
Why are the scores different? Learn how Snyk evaluates vulnerability scores
Overview
Affected versions of this package are vulnerable to Uncontrolled Recursion due to the parsing of heavily nested lists. An attacker can cause the application to crash by submitting a specially crafted list that triggers a RecursionError.

Note: The impact depends on the use, so anyone parsing a user input with sqlparse.parse() is affected.

Completion Criteria

• upgrade sqlparse v0.5.0