CVE-2026-71491

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0

Description A Denial of Service (DoS) issue exists where a statement consisting of numerous single-line comments can cause quadratic CPU consumption. This occurs because the group comments() function in sqlparse/engine/grouping.py repeatedly rescans comment-only statements, bypassing the MAX GROUPING TOKENS guard. The issue is reachable via the sqlparse.parse() function and the sqlparse.format() function when the strip comments parameter is set to True. This is particularly critical as it affects the primary sanitizer path used by ORMs, SQL firewalls, and query loggers.

Recommendations Update to version 0.6.0.