TI-2026-39184 CVE-2026-54284 · GHSA-pwgv-4x5q-6m9f
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
Priority HIGH 77
sqlparse is a non-validating SQL parser module for Python.
RHSA-2026:71112
Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update
Released 2026-09-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.7 for RHEL 10 python-sqlparse-0.6.0-1.el10ap, python3-sqlparse-0.6.0-1.el10ap, receptor-1.6.8-1.el10ap
- Red Hat Ansible Automation Platform 2.7 for RHEL 9 python3.12-sqlparse-0.6.0-1.el9ap, receptor-1.6.8-1.el9ap
Fixes 9 records
TI-2026-42707 CVE-2026-59893 · GHSA-prg7-hcfm-mfcr
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
Priority HIGH 72
sqlparse is a non-validating SQL parser module for Python.
TI-2026-50099 CVE-2026-71491 · GHSA-f2ff-p2ww-7p4p
sqlparse: Quadratic O(n²) DoS in group_comments
Priority MEDIUM 43
sqlparse is a non-validating SQL parser module for Python.
TI-2026-40999 CVE-2026-56862 · GHSA-7qch-w8m5-g3h3
Limit handshake messages we are willing to accept post-handshake in crypto/tls
Priority MEDIUM 40
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.
TI-2026-40997 CVE-2026-56859 · GHSA-76p8-fhrm-vpc7
Add recursion depth guard during decode in encoding/xml
Priority MEDIUM 40
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
TI-2026-40993 CVE-2026-56853 · GHSA-xphw-4f88-5f39
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Priority MEDIUM 40
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.
TI-2026-26189 CVE-2026-33818 · GHSA-xc2p-8ggw-6cr5
Enforce maximum recursion depth in encoding/asn1
Priority MEDIUM 40
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
TI-2026-40998 CVE-2026-56860 · GHSA-25mv-j2qr-v5jq
Avoid quadratic complexity in resolvePath in net/url
Priority LOW 27
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
TI-2026-40996 CVE-2026-56858 · GHSA-c974-w86c-vpfw
Fix Javascript regexp context tracking in html/template
Priority LOW 27
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.