High severityNVD Advisory· Published Aug 17, 2026· Updated Sep 9, 2026
CVE-2026-71491
CVE-2026-71491
Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sqlparsePyPI | < 0.6.0 | 0.6.0 |
Affected products
64- osv-coords63 versionspkg:apk/chainguard/netboxpkg:apk/chainguard/label-studiopkg:apk/chainguard/myclipkg:apk/chainguard/openstack-horizon-2026.1pkg:apk/chainguard/dbt-corepkg:apk/chainguard/openstack-placement-2025.1-fipspkg:apk/chainguard/openstack-placement-2025.2pkg:apk/chainguard/airflow-2pkg:apk/chainguard/openstack-placement-2026.1-fipspkg:apk/chainguard/authentik-2025.12pkg:apk/chainguard/dbt-bigquerypkg:apk/chainguard/openstack-keystone-2025.2pkg:apk/chainguard/openstack-horizon-2025.1-fipspkg:apk/chainguard/openstack-horizon-2025.2pkg:apk/chainguard/openstack-glance-2025.2-fipspkg:rpm/opensuse/python-sqlparse&distro=openSUSE%20Tumbleweedpkg:apk/chainguard/openstack-glance-2025.1pkg:apk/chainguard/openstack-glance-2025.1-fipspkg:apk/chainguard/openstack-glance-2025.2pkg:apk/chainguard/openstack-horizon-2025.1pkg:apk/chainguard/openstack-keystone-2025.1pkg:apk/chainguard/openstack-nova-2025.1pkg:apk/chainguard/openstack-placement-2026.1pkg:apk/chainguard/py3.12-airflow-3pkg:apk/chainguard/datahub-ingestion-fipspkg:apk/wolfi/airflow-3pkg:apk/chainguard/openstack-nova-2025.2pkg:apk/chainguard/superset-5.0pkg:apk/wolfi/mlflowpkg:apk/chainguard/openstack-horizon-2026.1-fipspkg:apk/chainguard/openstack-keystone-2025.1-fipspkg:apk/chainguard/airflow-3pkg:apk/chainguard/authentik-fips-2026.2pkg:apk/chainguard/datahub-ingestionpkg:apk/chainguard/apache-beam-python-3.14-sdkpkg:apk/chainguard/authentik-fips-2025.12pkg:apk/chainguard/mlflowpkg:apk/chainguard/pgadmin4-fipspkg:apk/chainguard/py3.12-airflow-postgres-fips-3pkg:apk/chainguard/openstack-horizon-2025.2-fipspkg:apk/chainguard/openstack-keystone-2025.2-fipspkg:rpm/opensuse/python-sqlparse&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/airflow-core-2pkg:apk/chainguard/authentik-2026.5pkg:apk/chainguard/pgadmin4pkg:apk/chainguard/py3.13-airflow-3pkg:apk/chainguard/py3.14-airflow-postgres-fips-3pkg:apk/chainguard/openstack-keystone-2026.1-fipspkg:apk/chainguard/openstack-placement-2025.2-fipspkg:apk/chainguard/openstack-keystone-2026.1pkg:apk/chainguard/py3.13-airflow-core-3pkg:apk/chainguard/mlflow-fipspkg:apk/chainguard/openstack-glance-2026.1-fipspkg:apk/chainguard/openstack-nova-2026.1pkg:apk/chainguard/openstack-placement-2025.1pkg:apk/chainguard/py3.13-airflow-postgres-fips-3pkg:apk/chainguard/py3.14-airflow-3pkg:apk/chainguard/py3.14-airflow-core-3pkg:apk/wolfi/myclipkg:apk/chainguard/openstack-glance-2026.1pkg:apk/chainguard/authentik-2026.2pkg:apk/chainguard/py3.12-airflow-core-3pkg:apk/chainguard/authentik-fips-2026.5
< 4.6.8-r1+ 62 more
- (no CPE)range: < 4.6.8-r1
- (no CPE)range: < 1.23.0-r12
- (no CPE)range: < 2.16.0-r1
- (no CPE)range: < 25.7.3_git20260814-r1
- (no CPE)range: < 1.12.3-r0
- (no CPE)range: < 13.0.0_git20260720-r2
- (no CPE)range: < 14.0.0_git20260617-r10
- (no CPE)range: < 2.11.2-r16
- (no CPE)range: < 15.0.0_git20260812-r1
- (no CPE)range: < 2025.12.6-r8
- (no CPE)range: < 1.10.3-r8
- (no CPE)range: < 28.0.1_git20260618-r8
- (no CPE)range: < 25.3.2_git20260617-r7
- (no CPE)range: < 25.5.2_git20260812-r1
- (no CPE)range: < 31.1.0_git20260812-r1
- (no CPE)range: < 0.6.0-1.1
- (no CPE)range: < 30.2.0_git20260616-r9
- (no CPE)range: < 30.2.0_git20260617-r9
- (no CPE)range: < 31.1.0_git20260818-r1
- (no CPE)range: < 25.3.2_git20260617-r8
- (no CPE)range: < 27.0.1_git20260807-r1
- (no CPE)range: < 31.3.0_git20260717-r4
- (no CPE)range: < 15.0.0_git20260806-r1
- (no CPE)range: < 3.3.1-r4
- (no CPE)range: < 1.7.0-r2
- (no CPE)range: < 3.3.1-r3
- (no CPE)range: < 32.2.0_git20260715-r3
- (no CPE)range: < 5.0.0-r33
- (no CPE)range: < 3.15.1-r4
- (no CPE)range: < 25.7.3_git20260813-r1
- (no CPE)range: < 27.0.1_git20260811-r1
- (no CPE)range: < 3.3.1-r3
- (no CPE)range: < 2026.2.6-r16
- (no CPE)range: < 1.7.0-r2
- (no CPE)range: < 2.75.0-r2
- (no CPE)range: < 2025.12.6-r9
- (no CPE)range: < 3.15.1-r4
- (no CPE)range: < 9.17-r1
- (no CPE)range: < 3.3.1-r2
- (no CPE)range: < 25.5.2_git20260812-r1
- (no CPE)range: < 28.0.1_git20260618-r8
- (no CPE)range: < 0.5.3-160000.4.1
- (no CPE)range: < 2.11.2-r7
- (no CPE)range: < 2026.5.6-r9
- (no CPE)range: < 9.17-r1
- (no CPE)range: < 3.3.1-r4
- (no CPE)range: < 3.3.1-r2
- (no CPE)range: < 29.0.1_git20260617-r10
- (no CPE)range: < 14.0.0_git20260309-r9
- (no CPE)range: < 29.0.1_git20260616-r8
- (no CPE)range: < 3.3.1-r1
- (no CPE)range: < 3.15.1-r3
- (no CPE)range: < 32.0.0_git20260810-r1
- (no CPE)range: < 33.0.1_git20260812-r1
- (no CPE)range: < 13.0.0_git20260720-r3
- (no CPE)range: < 3.3.1-r2
- (no CPE)range: < 3.3.1-r4
- (no CPE)range: < 3.3.1-r1
- (no CPE)range: < 2.16.0-r1
- (no CPE)range: < 32.0.0_git20260805-r1
- (no CPE)range: < 2026.2.6-r16
- (no CPE)range: < 3.3.1-r1
- (no CPE)range: < 2026.5.6-r10
- Range: <0.6.0
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.