{"cve":"CVE-2023-30608","nvd":{"published":"2023-04-18T22:15:08.267","modified":"2026-06-17T05:55:07.650","status":"Modified","description":"sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-1333"],"references":["https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb","https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a","https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2","https://lists.debian.org/debian-lts-announce/2023/05/msg00017.html","https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS"],"products":["debian:debian_linux","sqlparse_project:sqlparse"],"source":"nvd","synced_at":"2026-10-19T21:38:05.473481323+00:00"},"epss":{"cve":"CVE-2023-30608","score":0.0098,"percentile":0.62238,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-rrm6-wvj7-cwh2","url":"https://osv.dev/vulnerability/GHSA-rrm6-wvj7-cwh2","summary":"sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service","modified":"2025-11-04T17:36:56.468880Z","packages":[{"ecosystem":"PyPI","name":"sqlparse","purl":"pkg:pypi/sqlparse","ranges":[">=0.1.15 <0.4.4"],"fixed":["0.4.4"]}]},{"id":"PYSEC-2023-87","url":"https://osv.dev/vulnerability/PYSEC-2023-87","summary":"","modified":"2023-11-08T04:12:25.842993Z","packages":[{"ecosystem":"PyPI","name":"sqlparse","purl":"pkg:pypi/sqlparse","ranges":[">=0.1.15 <0.4.4"],"fixed":["0.4.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}