All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-59893
HIGHpublished 2026-08-17 18:17 UTC · 15 hours ago · modified 2026-08-17 19:16 UTC
7.5
CVSS / 10
// description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.
// weaknesses (CWE)
- CWE-1333