CVE-2026-71491: sqlparse Denial of Service Vulnerability Due to Quadratic Complexity in Group Comments
Summary
CVE-2026-71491: sqlparse: Quadratic O(n²) DoS in group_comments. Affects sqlparse versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a popular Python library used for parsing SQL statements. It provides functionalities for formatting and analyzing SQL queries, making it a valuable tool for developers working with databases. However, the library has a vulnerability that can lead to a Denial of Service (DoS) when processing certain types of input, specifically comment-only SQL statements.
Vulnerability Detail
The vulnerability arises from the 'group_comments' function in the sqlparse library, which processes SQL comments. When a statement consists solely of repeated single-line comments, the function exhibits quadratic time complexity (O(n²)). This inefficiency can lead to significant performance degradation, causing the application to become unresponsive or crash when handling large inputs of comment-only statements. The issue is exacerbated by the fact that this function is invoked during the primary sanitization process, making it a critical vector for potential DoS attacks.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
pip install --upgrade "sqlparse==0.6.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using sqlparse to process SQL statements that consist solely of comments. If you must handle such input, consider implementing a pre-check to filter out comment-only statements before passing them to sqlparse.
Conclusion
The sqlparse library has a significant vulnerability (CVE-2026-71491) that can lead to Denial of Service due to its quadratic processing time for comment-only SQL statements. It is crucial to update to version 0.6.0 or later to mitigate this risk. Users should also consider using Vulert for real-time monitoring of vulnerabilities in their applications.
See every vulnerability recorded for sqlparse →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The vulnerability is triggered by SQL statements that consist solely of repeated single-line comments, such as '-- c\n' repeated multiple times.
While the primary risk is Denial of Service, which can make the application unresponsive, there is no direct risk of data loss associated with this vulnerability.
If an immediate update is not possible, implement a workaround by filtering out comment-only statements before processing them with sqlparse.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
