Fluid Attacks Database

Description

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	sqlparse	=0.4.2-1 \|\| =0.4.2-1+deb12u1 \|\| =0.4.4-1 \|\| =0.5.0-1 \|\| =0.5.1-1 \|\| =0.5.1-2 \|\| =0.5.2-1 \|\| =0.5.3-1 \|\| =0.5.4-1 \|\| =0.5.5-1 \|\| =0.5.5-2	-
debian 14	sqlparse	=0.5.3-1 \|\| =0.5.4-1 \|\| =0.5.5-1 \|\| =0.5.5-2	-
debian 13	sqlparse	=0.5.3-1 \|\| =0.5.4-1 \|\| =0.5.5-1 \|\| =0.5.5-2	-
pypi	sqlparse	>=0 <0.6.0	0.6.0

Aliases

1. CVE-2026-714912. NVD-2026-714913. OSV-DEBIAN-2026-714914. OSV-2026-714915. GHSA-f2ff-p2ww-7p4p6. GCVE-2026-714917. SECURITY-TRACKER-CVE-2026-71491

References

1. https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p2. https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.