Python Library sqlparse < 0.6.0 Multiple Vulnerabilities

The version of the sqlparse Python library installed on the remote host is prior to 0.6.0. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability exists in sqlparse due to the regular expressions used by the lexer to match dollar-quoted strings and multiline...

Linux Distros Unpatched Vulnerability : CVE-2026-59893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py...

Linux Distros Unpatched Vulnerability : CVE-2026-59894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in...

Linux Distros Unpatched Vulnerability : CVE-2026-54284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten...

Linux Distros Unpatched Vulnerability : CVE-2026-71491

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statemen...

CVE-2026-54284

creationtimestamp| type| source ---|---|--- 2026-08-17 20:35:04+00:00| published-proof-of-concept| https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f 2026-08-18 01:00:04+00:00| published-proof-of-concept| Telegram/GwuC3cy-OzU2KFCuHYMrTkUTBOKWE1Dd5EfEUwy3SR6M 2026-08-...

CVE-2026-59893

creationtimestamp| type| source ---|---|--- 2026-08-17 20:35:02+00:00| published-proof-of-concept| https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr 2026-08-17 21:32:25+00:00| seen| https://gist.github.com/alon710/dfd35d68fb93e084af258814e55849da 2026-08-18...

CVE-2026-71491

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

UBUNTU-CVE-2026-71491

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

CVE-2026-59894

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...

CVE-2026-59893

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-54284

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

UBUNTU-CVE-2026-59893

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse,...

UBUNTU-CVE-2026-59894

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

Summary sqlparse contains a Regular Expression Denial of Service ReDoS vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference \1 to match closing dollar-quote delimiters, causing On² CPU complexity when processing inputs containing...

GHSA-PRG7-HCFM-MFCR sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

Summary sqlparse contains a Regular Expression Denial of Service ReDoS vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference \1 to match closing dollar-quote delimiters, causing On² CPU complexity when processing inputs containing...

sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

Summary sqlparse ships hard limits MAXGROUPINGDEPTH=100, MAXGROUPINGTOKENS=10000 intended to bound parsing work on attacker-supplied SQL, but the path that reaches those limits is itself Ondepth per token-group construction. A 1-2 KB SQL payload e.g. SELECT 1 ... with 500-2000 nesting levels, or ...

GHSA-PWGV-4X5Q-6M9F sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

Summary sqlparse ships hard limits MAXGROUPINGDEPTH=100, MAXGROUPINGTOKENS=10000 intended to bound parsing work on attacker-supplied SQL, but the path that reaches those limits is itself Ondepth per token-group construction. A 1-2 KB SQL payload e.g. SELECT 1 ... with 500-2000 nesting levels, or ...

CVE-2026-54284

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

EUVD-2026-60313

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...