PYSEC-2026-3696 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...

SUSE CVE-2026-59894

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...

CVE-2026-59894

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...

sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...

GHSA-3496-9G83-7V6X sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...

CVE-2026-59894

The sqlparse Python library (versions before 0.6.0) fails to escape existing backslashes before quotes in its output_format='python' and output_format='php' modes (sqlparse/filters/output.py:65 and :114). Crafted SQL can break out of the generated string and inject arbitrary Python or PHP code. A...

Linux Distros Unpatched Vulnerability : CVE-2019-3557

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some...

CVE-2025-24374 Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0...

Out-of-bounds

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations wer...

UBUNTU-CVE-2019-3557

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations wer...

CVE-2019-3557

CVE-2019-3557 affects HHVM, specifically all supported versions up to 3.30 and 3.27.4 and below. The root cause is improper readImpl implementations for streams backed by bz2 and php://output, which returned -1, causing some stream functions (for example, stream_get_line) to trigger an out-of-bou...

CVE-2019-3557

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations wer...

PT-2019-16606

Name of the Vulnerable Software and Affected Versions HHVM versions 3.30 and 3.27.4 and below Description The issue is related to the improper implementation of readImpl functions in streams for bz2 and php://output, which consistently returned -1. This caused certain stream functions, such as...

CVE-2019-3557: Out-of-bounds Read

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as streamgetline, to trigger an out-of-bounds read when operating on such malformed streams. The implementations wer...