High CPU Consumption Vulnerability in sqlparse Package
Summary
DEBIAN-CVE-2026-71491: sqlparse is a non-validating SQL parser module for Python. Affects sqlparse versions 0.4.1-1 – 0.5.5-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser module for Python, widely used for parsing SQL statements in various applications. It provides functionalities to format and analyze SQL queries, making it a popular choice among developers. However, prior to version 0.6.0, sqlparse contained a significant vulnerability that could lead to excessive CPU usage when processing certain SQL statements.
Vulnerability Detail
The vulnerability arises from the group_comments function in sqlparse/engine/grouping.py, which repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard. This flaw can lead to quadratic CPU consumption when using sqlparse.parse() or sqlparse.format(sql, strip_comments=True) on affected SQL statements. As a result, applications utilizing sqlparse may experience performance degradation, potentially leading to denial of service under heavy load.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to avoid using sqlparse on SQL statements that are comment-only or to limit the use of the parse and format functions until the package can be updated.
Conclusion
The sqlparse package has a vulnerability that can lead to high CPU consumption due to inefficient handling of comment-only SQL statements. It is crucial to update to version 0.6.0 or later to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for sqlparse →
FAQ
All versions prior to 0.6.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. By using the Vulert playground, you can check if your application is affected without any signup.
The vulnerability can lead to excessive CPU consumption, potentially causing performance issues or denial of service in applications that rely on sqlparse.
Yes, you can temporarily avoid using sqlparse on comment-only SQL statements or limit the use of its parse and format functions until an update is performed.
You can find more information about sqlparse on its official documentation or repository, which provides details on its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
