Vulnerability in sqlparse (CVE-2026-71491)
Summary
Vulnerability in sqlparse (CVE-2026-71491). Risk of unauthorized operations or information disclosure. Exploitable via group_comments. Mitigation: upgrade to 0.6.0 or later.
Original description
The description as published by the source.
Summary
A comment-only statement (-- c\n*n) may cause a Denial of Service (DoS).
Details
Location: sqlparse/engine/grouping.py:331-341 (group_comments), invoked first in group() at grouping.py:439. Reachable via sqlparse.parse() and sqlparse.format(sql, strip_comments=True).
A statement made of many single-line comments ('-- c\n' repeated) lexes in O(n) but group_comments is O(n²):
def group_comments(tlist):
tidx, token = tlist.token_next_by(t=T.Comment)
while token:
eidx, end = tlist.token_not_matching(
lambda tk: imt(tk, t=T.Comment) or tk.is_newline, idx=tidx)
...
tidx, token = tlist.token_next_by(t=T.Comment, idx=tidx)
The while loop runs n times and each token_next_by / token_not_matching rescans the O(n) remaining tokens. When all tokens are comments/newlines nothing ever groups, yet the full scan is repeated per token.
Two following factors increase the severity:
group_commentsruns first ingroup()(grouping.py:439), before the_group_matchingtoken-count guard (grouping.py:34-39). So the entire quadratic cost is paid even on oversized input.MAX_GROUPING_TOKENSdoes not provide protection on this vector.- It sits on the primary sanitizer path:
format(sql, strip_comments=True), used by query loggers, SQL firewalls, ORMs, and migration t…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-71491 has been found in sqlparse.
Attackers can target a specific entry point like group_comments over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade sqlparse to 0.6.0 or later.
If unsure, ask your IT team or search "sqlparse CVE-2026-71491" on the vendor's site.
CVE-2026-71491 (sqlparse) — CWE-400
Attack surface: group_comments / while / token_next_by / token_not_matching
Patched: 0.6.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-400) exists in sqlparse. Attackers reach the vulnerable code path via group_comments.
Check the vendor advisory for the affected versions of sqlparse. Attack surface: group_comments / while / token_next_by / token_not_matching.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 0.6.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'sqlparse' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'sqlparse' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
sqlparseを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade sqlparse to 0.6.0ステージング環境で 0.6.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- package pypi.org
- web github.com
- web github.com