CVE-2026-71491

EUVD-2026-60309
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.39%
Debian logo
Debian Releases
Debian Product
Codename
sqlparse
bookworm
postponed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
sqlparse
bionic
Fixed 0.2.4-0.1ubuntu0.1+esm1
released
focal
Fixed 0.2.4-3ubuntu0.1+esm1
released
jammy
Fixed 0.4.2-1ubuntu0.22.04.3
released
noble
Fixed 0.4.4-1ubuntu0.2
released
resolute
Fixed 0.5.4-1ubuntu0.1
released
xenial
Fixed 0.1.18-1ubuntu0.1~esm1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python3-sqlparse
suse enterprise sap 15 SP6
0.4.2-150300.23.1
fixed
suse enterprise server 15 SP4
0.4.2-150300.23.1
fixed
suse enterprise server 15 SP6
0.4.2-150300.23.1
fixed
python311-sqlparse
suse enterprise sap 15 SP6
0.4.4-150600.3.9.1
fixed
suse enterprise server 15 SP4
0.4.4-150400.6.16.1
fixed
suse enterprise server 15 SP6
0.4.4-150600.3.9.1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p