CVE-2026-71491: sqlparse Denial of Service Vulnerability Due to Quadratic Complexity in Comment Grouping
Summary
CVE-2026-71491: sqlparse: Quadratic O(n²) DoS in group_comments. Affects sqlparse versions < 0.6.0. Fixed in 0.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser for Python, designed to parse, format, and analyze SQL statements. It is widely used in applications that require SQL manipulation, such as query loggers, SQL firewalls, ORMs, and migration tools. The package allows users to handle SQL queries in a more manageable way, but it is susceptible to performance issues under certain conditions, particularly when processing large comment-only statements.
Vulnerability Detail
The vulnerability arises from a Denial of Service (DoS) condition in the 'group_comments' function of sqlparse. When a user inputs a statement consisting solely of many single-line comments (e.g., '-- c\n' repeated), the function exhibits quadratic time complexity, leading to excessive CPU usage and potential application hang. The 'group_comments' function is called during the parsing process, and its inefficiency can be exploited by attackers to create comment-heavy SQL statements that degrade performance significantly. This vulnerability is particularly severe because it is triggered during common operations like formatting SQL with comments stripped, making it a critical concern for applications relying on sqlparse.
How To Fix
Latest published version: 0.6.0 as of 23 Oct 2026
pip install --upgrade "sqlparse==0.6.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using sqlparse to process SQL statements that consist solely of comments. If you must handle such statements, consider implementing a pre-processing step to filter out excessive comments before passing them to sqlparse.
Conclusion
The sqlparse package contains a critical vulnerability (CVE-2026-71491) that can lead to Denial of Service due to quadratic complexity in comment grouping. Users are strongly advised to update to version 0.6.0 or later to mitigate this risk. Additionally, temporary workarounds can be employed to avoid processing problematic SQL statements.
See every vulnerability recorded for sqlparse →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
All versions of sqlparse prior to 0.6.0 are affected by this vulnerability.
The primary impact is a Denial of Service (DoS), where an attacker can exploit the vulnerability to cause significant CPU usage and application unresponsiveness.
Yes, you can avoid processing comment-only SQL statements with sqlparse as a temporary measure until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
