Executive brief
sqlparse is a Python SQL parser and formatter used in query loggers, SQL firewalls, ORMs, and migration tools to sanitize and analyze SQL queries. An attacker can cause severe CPU consumption and system slowdown by submitting SQL input consisting entirely of comment lines (e.g., `-- c` repeated thousands of times), triggering a quadratic-time algorithm in the comment grouping logic. A ~250 KB comment-only payload can force minutes of processing time regardless of token limits, effectively freezing applications that parse or format untrusted SQL.
Technical details
The vulnerability is an algorithmic complexity flaw (CWE-407: Inefficient Algorithmic Complexity) in the `group_comments()` function within `sqlparse/engine/grouping.py`. The function processes SQL comment tokens using a nested loop where the outer `while` loop iterates over each comment token (O(n) iterations) and each iteration invokes `token_next_by()` and `token_not_matching()` that rescan remaining tokens, resulting in O(n²) overall complexity. When input consists entirely of single-line comments or comments interspersed with newlines, grouping operations fail but the full quadratic scan is still performed. The vulnerability is reachable via `sqlparse.parse()` and `sqlparse.format(sql, strip_comments=True)`, the latter being the primary code path for query sanitization in production systems. Because `group_comments()` runs before the `_group_matching` token-count guard, the quadratic cost is incurred even on oversized input, rendering the `MAX_GROUPING_TOKENS` limit ineffective. Proof-of-concept testing confirms timing scales as O(n²): a ~250 KB payload (~4000 comment lines) requires ~1.6 seconds to process. No authentication or user interaction is required; any network-reachable application processing untrusted SQL is vulnerable. The fix is available in version 0.6.0.
Affected products
- sqlparse sqlparse <= 0.5.5
Timeline
- 2026-08-17: disclosed: CVE-2026-71491 and GHSA-f2ff-p2ww-7p4p published
- 2026-08-10: patched: Fix released in sqlparse 0.6.0