CVE-2026-71491: sqlparse quadratic DoS in group_comments

CVE-2026-71491 · Severity: high · CVSS 4 · Published 2026-08-17

sqlparse is a Python SQL parser and formatter used in query loggers, SQL firewalls, ORMs, and migration tools to sanitize and analyze SQL queries. An attacker can cause severe CPU consumption and system slowdown by submitting SQL input consisting entirely of comment lines (e.g., `-- c` repeated thousands of times), triggering a quadratic-time algorithm in the comment grouping logic. A ~250 KB comment-only payload can force minutes of processing time regardless of token limits, effectively freezing applications that parse or format untrusted SQL.

Technologies: sqlparse (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-71491 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71491 being exploited in the wild.
How severe is CVE-2026-71491?
High severity, with a CVSS score of 4, published 17 August 2026.
Which products and versions are affected?
sqlparse (PyPI) <= 0.5.5, ECOSYSTEM:introduced=0,fixed=0.6.0.
Is there a fix for CVE-2026-71491?
Yes. sqlparse (PyPI): upgrade to 0.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71491 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71491?
Check whether you run sqlparse (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sqlparse (PyPI): upgrade to 0.6.0 or later
    pip install "sqlparse>=0.6.0"

Technical details

The vulnerability is an algorithmic complexity flaw (CWE-407: Inefficient Algorithmic Complexity) in the `group_comments()` function within `sqlparse/engine/grouping.py`. The function processes SQL comment tokens using a nested loop where the outer `while` loop iterates over each comment token (O(n) iterations) and each iteration invokes `token_next_by()` and `token_not_matching()` that rescan remaining tokens, resulting in O(n²) overall complexity. When input consists entirely of single-line comments or comments interspersed with newlines, grouping operations fail but the full quadratic scan is still performed. The vulnerability is reachable via `sqlparse.parse()` and `sqlparse.format(sql, strip_comments=True)`, the latter being the primary code path for query sanitization in production systems. Because `group_comments()` runs before the `_group_matching` token-count guard, the quadratic cost is incurred even on oversized input, rendering the `MAX_GROUPING_TOKENS` limit ineffective. Proof-of-concept testing confirms timing scales as O(n²): a ~250 KB payload (~4000 comment lines) requires ~1.6 seconds to process. No authentication or user interaction is required; any network-reachable application processing untrusted SQL is vulnerable. The fix is available in version 0.6.0.

Affected products

  • sqlparse sqlparse <= 0.5.5

Identifiers

  • CVE-2026-71491
  • GHSA-f2ff-p2ww-7p4p
  • PYSEC-2026-3697

Timeline

  • 2026-08-17: disclosed: CVE-2026-71491 and GHSA-f2ff-p2ww-7p4p published
  • 2026-08-10: patched: Fix released in sqlparse 0.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.