CVE-2026-59893
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.
- Affected products
- Sqlparse
- CVSS 3.1
- 7.5 HIGH
- Weakness
- CWE-1333
- NVD status
- Received
- Published
- 2026-08-17
CVE-2026-59893 at NVD
1 known exploit for CVE-2026-59893
Proof-of-concept code and exploit modules indexed by Sploitus