SB2026082545 - SUSE update for python-sqlparse
Published: August 25, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-54284)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in TokenList.__init__ when parsing attacker-supplied SQL with deeply nested grouping constructs. A remote attacker can send a specially crafted SQL input to cause a denial of service.
The issue is reachable through the default sqlparse.parse, sqlparse.format, and sqlparse.split entry points, and nested parentheses, nested CASE WHEN expressions, nested subqueries, or nested ARRAY[] literals can trigger excessive CPU consumption before parser depth and token caps raise an error.
2) Inefficient regular expression complexity (CVE-ID: CVE-2026-59893)
CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in the dollar-quoted SQL literal lexer and multiline comment patterns when parsing user-supplied SQL text. A remote attacker can send specially crafted SQL input with unmatched dollar-quote delimiters or unterminated comment openers to cause a denial of service.
A single crafted request carrying SQL text is sufficient to trigger sustained CPU exhaustion.
3) Code Injection (CVE-ID: CVE-2026-59894)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of generation of code in the Python and PHP output filters when generating source-code snippets from caller-supplied SQL. A remote attacker can supply crafted SQL containing backslashes and quotes to execute arbitrary code.
Formatting alone does not execute the payload; exploitation requires a downstream workflow to execute or import the generated Python or PHP snippet. User interaction is required to trigger execution of the generated source.
4) Resource exhaustion (CVE-ID: CVE-2026-71491)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the group_comments function when parsing a comment-only SQL statement. A remote attacker can supply many single-line comments to consume excessive CPU resources and cause a denial of service.
The issue is reachable via sqlparse.parse() and sqlparse.format(sql, strip_comments=true), and the quadratic cost is incurred before the token-count guard is applied.
Remediation
Install update from vendor's website.