VulnerabilityReceived

CVE-2026-59893

sqlparse is a non-validating SQL parser module for Python.

HIGH 7.5EPSS 0.28%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.28% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-1333
Source: security-advisories@github.com

References

https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.