CVE-2026-59893

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0

Description sqlparse contains a Regular Expression Denial of Service (ReDoS) issue where the lexer repeatedly scans unmatched dollar-quoted literals and multiline-comment delimiters. This occurs because the regex patterns in sqlparse/keywords.py use a lazy quantifier that, when paired with a missing closing delimiter, forces the engine to scan the remaining input at every character position. This results in quadratic CPU consumption (O(n²)) when processing specially crafted SQL text, potentially leading to sustained CPU exhaustion and service unavailability. The issue is triggered through the sqlparse.parse(), sqlparse.format(), and sqlparse.split() functions. Specifically, the SQL REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py are the vulnerable components.

Recommendations Update sqlparse to version 0.6.0 or later.