CVE-2026-71491: sqlparse: Quadratic O(n²) DoS in group_comments
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, stripcomments=True). This issue is fixed in version 0.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sqlparseto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71491?
CVE-2026-71491 is rated with a risk level of 28.
How do I fix CVE-2026-71491?
To fix CVE-2026-71491, upgrade sqlparse to version 0.6.0 or later.
What is the impact of CVE-2026-71491?
CVE-2026-71491 can lead to a Denial of Service (DoS) due to excessive CPU consumption.
Which versions of sqlparse are affected by CVE-2026-71491?
CVE-2026-71491 affects all sqlparse versions prior to 0.6.0.
What type of attack does CVE-2026-71491 represent?
CVE-2026-71491 represents a quadratic time complexity issue that can be exploited for Denial of Service.