High CPU Consumption Vulnerability in sqlparse Package
Summary
DEBIAN-CVE-2026-59893: sqlparse is a non-validating SQL parser module for Python. Affects sqlparse versions 0.4.1-1 – 0.5.5-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
sqlparse is a non-validating SQL parser module for Python, widely used for parsing SQL statements. It provides functionalities such as formatting and splitting SQL queries, making it a valuable tool for developers working with databases. However, prior to version 0.6.0, sqlparse had a significant vulnerability that could lead to excessive CPU usage under certain conditions.
Vulnerability Detail
The vulnerability arises from the SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py, which repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters. This results in quadratic CPU consumption when using functions like sqlparse.parse(), sqlparse.format(), and sqlparse.split(). If exploited, this could lead to performance degradation and denial of service, especially in applications that handle large or complex SQL queries.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the complexity of SQL queries being processed or avoid using dollar-quoted literals and multiline comments until the package is updated. This may help reduce CPU consumption in the interim.
Conclusion
The sqlparse package has a critical vulnerability that can lead to high CPU consumption, affecting application performance. It is essential to update to version 0.6.0 or later to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for sqlparse →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions prior to 0.6.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
The vulnerability can lead to excessive CPU consumption, resulting in performance issues and potential denial of service in applications that utilize sqlparse.
Yes, you can limit the complexity of SQL queries processed by sqlparse or avoid using dollar-quoted literals and multiline comments as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlparse.
