CVE-2026-59893CWE-1333

CVE-2026-59893

High · published August 17, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
25.9
In the wild
Unconfirmed
What it is

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00337 · 25.9th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2026-08-17T22:17Z
References (3)
https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e · [email protected]https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr · [email protected]https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 AUG 17:41Z
    sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
    cvelistv5