CVE-2026-71491

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

CVE-2026-54284 sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-54284

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-59893

The vulnerability is a ReDoS flaw in sqlparse's lexer: the regex at sqlparse/keywords.py:33 uses a backreference (\1) to match closing dollar-quote delimiters, causing O(n²) CPU consumption when fed many unique, unmatched openers. The same pattern shape affects multiline-comment regexes. A single...

CVE-2026-71491 sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

BIT-SUPERSET-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

PT-2026-76720

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description The sqlparse/filters/output.py module fails to escape existing backslashes before quotes when using output format='python' or output format='php' in the sqlparse.format function and the correspondin...

CLSA-2026-1786469793 mariadb: Fix of 2 CVEs

CVE-2026-3494: replace the serveraudit plugin's hand-rolled SQL parser with thdsqlcommand; emit MYSQLAUDITGENERALSTATUS inside Preparedstatement::execute; update thd-updateserverstatus guard in spinstrstmt::execute to include audit-enabled path - CVE-2026-44171: reject unsafe absolute,...

CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

CVE-2026-23985

CVE-2026-23985 is a ReDoS vulnerability in Apache Superset versions 1.5.0–5.0.0, arising from the sql_parse.py component’s integration with the sqlparse library. The issue centers on the SQL_REGEX used to parse SQL statements, where overlapping disjunctions share a common outer quantifier, enabli...

CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

sqlfluff-templater-dbt (2.1.0), tableau-sql-parser (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-46373 via sqlfluff (2.1.0)

sqlfluff PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 2.1.0 - tableau-sql-parser =0.1.0, =0.1.1 Source cves: CVE-2026-46373 Source advisory: OSV:PYSEC-2026-209...

sqlfluff-templater-dbt (2.1.0), tableau-sql-parser (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-46374 via sqlfluff (2.1.0)

sqlfluff PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 2.1.0 - tableau-sql-parser =0.1.0, =0.1.1 Source cves: CVE-2026-46374 Source advisory: OSV:PYSEC-2026-210...

sqlfluff-templater-dbt (2.1.0), tableau-sql-parser (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-46374 via sqlfluff (2.1.0)

sqlfluff PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 2.1.0 - tableau-sql-parser =0.1.0, =0.1.1 Source cves: CVE-2026-46374 Source advisory: OSV:GHSA-73JC-5MRQ-PRW7...

Uncontrolled Recursion

Overview sqlfluffrs is a The SQL Linter for Humans Affected versions of this package are vulnerable to Uncontrolled Recursion through the ParseContext and parser recursion in the SQL parser components. An attacker can exhaust parser stack depth and force repeated parse failures by supplying deepl...

sqlfluff-templater-dbt (2.1.0), tableau-sql-parser (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-46373 via sqlfluff (2.1.0)

sqlfluff PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - sqlfluff-templater-dbt 2.1.0 - tableau-sql-parser =0.1.0, =0.1.1 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...

PT-2026-48588

Уязвимость функционала форматирования модуля парсера SQL для Python Sqlparse связана с недостаточным контролем ресурса в период его существования. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

EUVD-2016-3150

Malware in sbrugna...

EUVD-2022-3057

Malicious code in bioql PyPI...

PostHog Plugin Server SQL Injection Vulnerability

PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the...