CVE-2026-71491
Received Received - Intake

Denial of Service in sqlparse via Comment Parsing

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-71491
EUVD
EUVD-2026-60309

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
andialbrecht sqlparse to 0.6.0 (exc)
andialbrecht sqlparse 0.6.0
sqlparse sqlparse 0.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a quadratic time complexity Denial of Service (DoS) vulnerability in the sqlparse library affecting versions 0.5.5 and earlier. It occurs when processing comment-only statements like repeated single-line comments. The group_comments function in sqlparse/engine/grouping.py inefficiently rescans tokens, causing O(n²) CPU consumption instead of O(n). This leads to excessive CPU usage when parsing large inputs.

Detection Guidance

To detect this vulnerability, check if your system uses sqlparse versions 0.5.5 or earlier. Run: pip show sqlparse. If installed, verify version with: python -c "import sqlparse; print(sqlparse.__version__)". If vulnerable, update to version 0.6.0 or later.

Impact Analysis

This vulnerability can cause significant performance degradation or system crashes by consuming excessive CPU resources. It impacts tools using sqlparse like query loggers, SQL firewalls, ORMs, and migration tools. A 250 KB payload of comments could consume minutes of CPU time, making systems unresponsive during parsing operations.

Compliance Impact

This vulnerability causes excessive CPU consumption due to quadratic time complexity when processing comment-only SQL statements. While it does not directly expose or leak data, it can disrupt system availability, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.312).

Mitigation Strategies

Immediately update sqlparse to version 0.6.0 or later using: pip install --upgrade sqlparse. If updating is not possible, avoid processing SQL inputs with excessive comments or disable comment stripping in sqlparse.format().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71491. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart