CVE-2026-59893: sqlparse Denial of Service via Inefficient Regex Handling of Dollar-Quoted SQL Literals
Summary
CVE-2026-59893: sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service). Affects sqlparse versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a popular Python library used for parsing SQL statements. It provides a simple interface for formatting and splitting SQL queries, making it a valuable tool for developers working with databases. However, sqlparse has a vulnerability that can lead to denial of service due to inefficient handling of regular expressions, particularly in dollar-quoted SQL literals.
Vulnerability Detail
The vulnerability in sqlparse arises from a Regular Expression Denial of Service (ReDoS) issue in its lexer for dollar-quoted SQL literals. The regex pattern used to match closing dollar-quote delimiters employs a backreference, which can cause O(n²) CPU complexity when processing inputs with many unique unmatched dollar-quote opening sequences. An attacker can exploit this vulnerability by supplying crafted SQL text, leading to sustained CPU exhaustion and denial of service. This issue does not require any authentication or special privileges, making it easily exploitable.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
pip install --upgrade "sqlparse==0.6.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing user-controlled SQL text directly to sqlparse functions such as parse(), format(), or split(). Implement input validation to restrict the types of SQL queries that can be processed.
Conclusion
The sqlparse library has a critical vulnerability (CVE-2026-59893) that can lead to denial of service through inefficient regex handling. It is essential to update to the patched version to protect your applications from potential exploitation. Utilize tools like Vulert for ongoing monitoring of vulnerabilities in your software.
See every vulnerability recorded for sqlparse →
FAQ
CVE-2026-59893 is a vulnerability in the sqlparse library that can lead to denial of service due to inefficient regex handling of dollar-quoted SQL literals.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Update sqlparse to version 0.6.0 or later using the command pip install --upgrade sqlparse to mitigate this vulnerability.
Yes, this vulnerability can be exploited without any authentication or special privileges, making it a significant risk for applications using sqlparse.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
