CVE-2026-71491
published 2026-08-17CVE-2026-71491: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only…
PriorityP349high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.26%
17.2th percentile
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.
Affected
205 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| andialbrecht | sqlparse | < 0.6.0 | 0.6.0 |
| ansible-automation-platform-24 | controller-rhel8 | — | — |
| ansible-automation-platform-24 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-24 | hub-rhel8 | — | — |
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | ansible-dev-tools-rhel8 | — | — |
| ansible-automation-platform-25 | controller-rhel8 | — | — |
| ansible-automation-platform-25 | eda-controller-rhel8 | — | — |
| ansible-automation-platform-25 | gateway-rhel8 | — | — |
| ansible-automation-platform-25 | hub-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-26 | controller-rhel9 | — | — |
| ansible-automation-platform-26 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-26 | hub-rhel9 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | aap-cloud-billing-rhel9 | — | — |
| ansible-automation-platform-27 | ansible-dev-tools-rhel9 | — | — |
| ansible-automation-platform-27 | controller-rhel9 | — | — |
| ansible-automation-platform-27 | eda-controller-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | hub-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | metrics-service-rhel9 | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
SQL parse vulnerabilities
vendor_ubuntu·2026-09-23
CVE-2026-54284 SQL parse vulnerabilities
Title: SQL parse vulnerabilities
Summary: SQL parse could be made to crash if it received specially crafted input.
It was discovered that SQL parse contained multiple algorithmic complexity
flaws when parsing SQL statements with deeply nested parentheses, comments,
or dollar-quoted string literals. An attacker could use this issue to cause
SQL parse to consume excessive CPU resources, resulting in a denial of
service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping
vendor_redhat·2026-08-17·CVSS 8.7
CVE-2026-71491 [HIGH] CWE-1050 sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping
sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.
A flaw was found in sqlparse, a Python module for parsing SQL. A remote attacker could exploit this vulnerability by providing specially crafted SQL input that contains numerous comment-only statements. This could cause the `group_comments` function to repeatedly rescan these statements, leading to excessive CPU consumption and a Denial of Service (DoS) for the
GHSA
sqlparse: Quadratic O(n²) DoS in group_comments
ghsa·2026-08-17
CVE-2026-71491 [HIGH] CWE-400 sqlparse: Quadratic O(n²) DoS in group_comments
sqlparse: Quadratic O(n²) DoS in group_comments
### Summary
A comment-only statement (`-- c\n`*n) may cause a Denial of Service (DoS).
### Details
Location: [sqlparse/engine/grouping.py:331-341](https://github.com/andialbrecht/sqlparse/blob/f80af6a4007f11ada847218df8c29dc859238290/sqlparse/engine/grouping.py#L332) (`group_comments`), invoked first in `group()` at `grouping.py:439`. Reachable via `sqlparse.parse()` and `sqlparse.format(sql, strip_comments=True)`.
A statement made of many single-line comments (`'-- c\n'` repeated) lexes in O(n) but `group_comments` is O(n²):
```python
def group_comments(tlist):
tidx, token = tlist.token_next_by(t=T.Comment)
while token:
eidx, end = tlist.token_not_matching(
lambda tk: imt(tk, t=T.Comment) or tk.is_newline, idx=tidx)
...
tidx, token = tli
No detection rules found.
No public exploits indexed.
2026-08-17
Published