CVE-2024-4340

Deeper analysis

CVE-2024-4340 is an uncontrolled recursion vulnerability (CWE-674) in the sqlparse Python library. Passing a heavily nested list to the sqlparse.parse() function triggers a RecursionError that crashes the calling process, resulting in a denial of service. The flaw affects any application that invokes sqlparse on untrusted or attacker-controlled input and carries a CVSS 3.1 score of 7.5.

An unauthenticated remote attacker can exploit the issue by supplying a maliciously crafted SQL string or nested structure to any service that uses sqlparse.parse() without prior depth validation. Successful exploitation requires only network reachability and produces an immediate application crash or worker restart, with no impact on confidentiality or integrity.

Public advisories and the referenced GitHub security advisory GHSA-2m57-hf25-phgg point to commit b4a39d9850969b4e1d6940d32094ee0b42a2cf03 as the corrective patch; users are advised to upgrade to a version containing this change. The JFrog research note further recommends input sanitization or recursion-depth limits as interim controls until patching is complete.

EPSS for the CVE rose from a low baseline to a peak of 0.1704 (current value 0.1088), indicating measurable post-disclosure exploitation interest that warrants renewed attention from defenders.