Multiple security vulnerabilities have been identified in sqlparse, a package used for parsing SQL queries. The overall risk/impact is significant, as these vulnerabilities can lead to Denial of Service (DoS) and potentially allow SQL string breakout. Affected version range is not explicitly stated.
CVE-2026-59894 (CVSS 7.5 — High): Generated Python and PHP snippets in sqlparse allow SQL string breakout through unescaped backslashes, which can be exploited by an attacker with moderate skill level.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in sqlparse, a package used for parsing SQL queries. The overall risk/impact is significant, as these vulnerabilities can lead to Denial of Service (DoS) and potentially allow SQL string breakout. Affected version range is not explicitly stated.
CVE-2026-59894 (CVSS 7.5 — High): Generated Python and PHP snippets in sqlparse allow SQL string breakout through unescaped backslashes, which can be exploited by an attacker with moderate skill level.[emaillocker id="1283"]
CVE-2026-71491 (CVSS 8.1 — Critical): A Quadratic O(n²) DoS vulnerability exists in the group_comments functionality of sqlparse, allowing an attacker to cause a denial-of-service condition.
CVE-2026-54284 (CVSS 7.5 — High): The TokenList.__init__ function in sqlparse materializes an O(subtree) value per group, causing CPU Denial of Service before depth/token caps trigger, which can be exploited by an attacker with moderate skill level.
CVE-2026-59893: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) in sqlparse, allowing an attacker to cause a denial-of-service condition.
These vulnerabilities collectively present a significant risk to administrators who manage systems that rely on the sqlparse package.
We recommend you to update sqlparse to version 0.6.0.
The following reports contain further technical details:
[/emaillocker]