TI-2026-39184 CVE-2026-54284 · GHSA-pwgv-4x5q-6m9f
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
Priority HIGH 77
sqlparse is a non-validating SQL parser module for Python.
andialbrecht
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
andialbrecht records in CISA KEVNo andialbrecht vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-42707 CVE-2026-59893 · GHSA-prg7-hcfm-mfcr
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
Priority HIGH 72
sqlparse is a non-validating SQL parser module for Python.
TI-2026-57940 CVE-2026-84305 · GHSA-cfqr-cjx5-5jcm
sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption
Priority MEDIUM 56
sqlparse is a non-validating SQL parser module for Python.
TI-2026-50099 CVE-2026-71491 · GHSA-f2ff-p2ww-7p4p
sqlparse: Quadratic O(n²) DoS in group_comments
Priority MEDIUM 43
sqlparse is a non-validating SQL parser module for Python.
TI-2026-76501 CVE-2026-112307 · GHSA-457h-p88w-wq8p
PHP code injection in sqlparse via output_format='php'
Priority LOW 37
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs.
TI-2026-42708 CVE-2026-59894 · GHSA-3496-9g83-7v6x
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
Priority LOW 27
sqlparse is a non-validating SQL parser module for Python.