Skip to main content

sqlparse EUVDEUVD-2026-60309

| CVE-2026-71491 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-08-17 GitHub_M GHSA-f2ff-p2ww-7p4p
Denial Of Service Python Sqlparse Andialbrecht
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable with no auth or complexity; sole impact is CPU exhaustion causing availability loss with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 17, 2026 - 18:16 EUVD
Source Code Evidence Fetched
Aug 17, 2026 - 17:53 vuln.today
Analysis Generated
Aug 17, 2026 - 17:53 vuln.today
CVE Published
Aug 17, 2026 - 17:16 cve.org
HIGH 8.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 17,859 pypi packages depend on sqlparse (759 direct, 17,164 indirect)

Ecosystem-wide dependent count for version 0.6.0.

DescriptionCVE.org

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.

Articles & Coverage 1

News 10 New Python Vulnerabilities - 3 Critical, 7 High, 2 With POC Aug 18, 2026

AnalysisAI

Quadratic CPU consumption in sqlparse's group_comments function (grouping.py) allows remote unauthenticated denial of service against any Python application that passes attacker-controlled input to sqlparse.parse() or sqlparse.format(sql, strip_comments=True). A comment-only payload of roughly 250 KB forces minutes of CPU burn regardless of the MAX_GROUPING_TOKENS guard, because group_comments executes before that cap is checked. A public proof-of-concept with benchmark data confirms O(n²) scaling: n=4000 comments takes ~1600 ms versus ~106 ms at n=1000; no public exploit identified at time of analysis beyond the researcher's PoC, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

sqlparse (CPE: cpe:2.3:a:andialbrecht:sqlparse:*:*:*:*:*:*:*:*) is a non-validating Python SQL parser widely used for query formatting, sanitization, and introspection. CWE-400 (Uncontrolled Resource Consumption) applies: the root cause is an algorithmic complexity flaw in group_comments (sqlparse/engine/grouping.py lines 331-341). The function uses a while loop that runs n times over comment tokens, and inside each iteration calls token_next_by and token_not_matching, both of which rescan O(n) remaining tokens. For a comment-only statement, no tokens ever group, so every pass rescans the full tail, yielding O(n²) total work. Critically, group_comments is invoked first in the group() pipeline at line 439 - before the MAX_GROUPING_TOKENS guard at lines 34-39 - meaning the 10,000-token cap offers zero protection on this code path. Both sqlparse.parse() and sqlparse.format(sql, strip_comments=True) are affected. The latter sits on a primary sanitizer path used by query loggers, SQL firewalls, ORMs, and migration tooling, substantially widening the exposure surface.

RemediationAI

Vendor-released patch: sqlparse 0.6.0. Upgrade immediately via pip: pip install 'sqlparse>=0.6.0'. The fix is confirmed in commit ef2012a5eeb491e604dea2b00d516904a3830c87 (https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87), which breaks the quadratic loop early when no terminator token exists, reducing group_comments to O(n). Advisory: https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p. If immediate upgrade is not possible, apply input length limits upstream: cap SQL input at a conservative byte size (e.g., 50 KB) before it reaches sqlparse.parse() or sqlparse.format(), since the vulnerability scales with comment count. Trade-off: hard length limits may reject legitimate large queries. An alternative compensating control is to run sqlparse calls in a subprocess or thread with a CPU timeout, terminating any call exceeding a defined threshold (e.g., 500 ms); this prevents full process saturation but adds latency overhead. Do not rely on MAX_GROUPING_TOKENS as a mitigation - it does not guard the group_comments code path.

More in Python

View all
CVE-2025-24016 CRITICAL POC
9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
CVE-2025-27520 CRITICAL POC
9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
CVE-2025-2945 CRITICAL POC
9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
CVE-2013-5093 MEDIUM POC
6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL POC
9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2024-21644 HIGH POC
7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
CVE-2026-33017 CRITICAL POC
9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
CVE-2017-9462 HIGH POC
8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
CVE-2026-49869 CRITICAL POC
10.0 Jun 26

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2024-21645 MEDIUM POC
5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

EUVD-2026-60309 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy