SB2026081381 - Multiple vulnerabilities in Sqlparse

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081381

SB2026081381 - Multiple vulnerabilities in Sqlparse

Published: August 13, 2026

Security Bulletin ID SB2026081381
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact

Breakdown by Severity

High 20% Medium 60% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Code Injection (CVE-ID: CVE-2026-59894)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of generation of code in the Python and PHP output filters when generating source-code snippets from caller-supplied SQL. A remote attacker can supply crafted SQL containing backslashes and quotes to execute arbitrary code.

Formatting alone does not execute the payload; exploitation requires a downstream workflow to execute or import the generated Python or PHP snippet. User interaction is required to trigger execution of the generated source.


2) Resource exhaustion (CVE-ID: CVE-2026-71491)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the group_comments function when parsing a comment-only SQL statement. A remote attacker can supply many single-line comments to consume excessive CPU resources and cause a denial of service.

The issue is reachable via sqlparse.parse() and sqlparse.format(sql, strip_comments=true), and the quadratic cost is incurred before the token-count guard is applied.


3) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in ReindentFilter when formatting attacker-controlled SQL with reindentation enabled. A remote attacker can supply a specially crafted parenthesized tuple-list input to cause a denial of service.

The issue is reachable through sqlparse.format(sql, reindent=True) and the sqlformat --reindent mode.


4) Inefficient regular expression complexity (CVE-ID: CVE-2026-59893)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the dollar-quoted SQL literal lexer and multiline comment patterns when parsing user-supplied SQL text. A remote attacker can send specially crafted SQL input with unmatched dollar-quote delimiters or unterminated comment openers to cause a denial of service.

A single crafted request carrying SQL text is sufficient to trigger sustained CPU exhaustion.


5) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-54284)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in TokenList.__init__ when parsing attacker-supplied SQL with deeply nested grouping constructs. A remote attacker can send a specially crafted SQL input to cause a denial of service.

The issue is reachable through the default sqlparse.parse, sqlparse.format, and sqlparse.split entry points, and nested parentheses, nested CASE WHEN expressions, nested subqueries, or nested ARRAY[] literals can trigger excessive CPU consumption before parser depth and token caps raise an error.


Remediation

Install update from vendor's website.

References