CVE-2026-59893

EUVD-2026-60311
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 24.7%
Debian logo
Debian Releases
Debian Product
Codename
sqlparse
bookworm
postponed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sqlparse
bionic
Fixed 0.2.4-0.1ubuntu0.1+esm1
released
focal
Fixed 0.2.4-3ubuntu0.1+esm1
released
jammy
Fixed 0.4.2-1ubuntu0.22.04.3
released
noble
Fixed 0.4.4-1ubuntu0.2
released
resolute
Fixed 0.5.4-1ubuntu0.1
released
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python3-sqlparse
suse enterprise sap 15 SP6
0.4.2-150300.23.1
fixed
suse enterprise server 15 SP4
0.4.2-150300.23.1
fixed
suse enterprise server 15 SP6
0.4.2-150300.23.1
fixed
python311-sqlparse
suse enterprise sap 15 SP6
0.4.4-150600.3.9.1
fixed
suse enterprise server 15 SP4
0.4.4-150400.6.16.1
fixed
suse enterprise server 15 SP6
0.4.4-150600.3.9.1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr