CVE-2026-59893

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-54284: Inefficient Algorithmic Complexity

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-71491: Uncontrolled Resource Consumption

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

PT-2026-76735

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description sqlparse contains a Regular Expression Denial of Service ReDoS issue where the lexer repeatedly scans unmatched dollar-quoted literals and multiline-comment delimiters. This occurs because the regex...

PT-2026-76736

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description A Denial of Service DoS issue exists where a statement consisting of numerous single-line comments can cause quadratic CPU consumption. This occurs because the group comments function in...

CVE-2026-59893: Inefficient Regular Expression Complexity

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse,...

PT-2026-84379

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description An issue exists when SQL is formatted with reindentation enabled, where the ReindentFilter repeatedly rebuilds prefixes of the current statement to calculate token offsets. An attacker providing a...

NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution 3.x and 4.x — CVE-2026-59870 fix not backported vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.1...

DoS (Denial of Service) js-yaml Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector o...

EUVD-2026-42321

linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text...

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.1.0...

EUVD-2026-42301

js-yaml: YAML merge-key chains can force quadratic CPU consumption...

GHSA-52CP-R559-CP3M js-yaml: YAML merge-key chains can force quadratic CPU consumption

Impact js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one: yaml a0: &a0 k0: 0 a1: &a1 1s doc size 100K js import performance from 'node:perfhooks' import Buffer from...

EUVD-2025-203029

Tornado: Quadratic DoS via Crafted Multipart Parameters...

CVE-2026-56669 Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of...

CVE-2026-59887

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test and .match can be invoked at every mailto: occurrence and scan the remaining input through srcemailname in lib/re.mjs, causing On^2 CPU consumption on crafted user text...

AZL-92192 CVE-2026-59869 affecting package js-jquery 3.5.0-4

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

CVE-2026-59868

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

CVE-2026-59868 js-yaml: YAML merge-key chains can force quadratic CPU consumption

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in...

CVE-2026-59868

The CVE-2026-59868 Issue: js-yaml (JavaScript YAML parser/dumper) is vulnerable when merge keys are enabled. From versions 5.0.0 up to 5.2.0, a chain of mappings using merge keys can cause quadratic CPU time on documents that grow linearly, leading to DoS under some inputs. A fix was released in ...