CVE-2026-59893 json
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
published 2026-08-17 2 mo ago modified 2026-10-23 16 d ago also GHSA-prg7-hcfm-mfcr , PYSEC-2026-3698 , EUVD-2026-60311
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.
Patch / fix
- pypi sqlparse 0.6.0
- sqlparse Ubuntu 22.04 LTS 0.4.2-1ubuntu0.22.04.3
- sqlparse Ubuntu 24.04 LTS 0.4.4-1ubuntu0.2
- sqlparse Ubuntu 26.04 LTS 0.5.4-1ubuntu0.1
- sqlparse Ubuntu Pro 18.04 LTS 0.2.4-0.1ubuntu0.1+esm1
- sqlparse Ubuntu Pro 20.04 LTS 0.2.4-3ubuntu0.1+esm1
ubuntu advisories UBUNTU-CVE-2026-59893
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- foreman satellite utils 6.17, satellite capsule 6.17, satellite 6.17 3.14.0.22-1.el9sat
- satellite satellite utils 6.17, satellite capsule 6.17, satellite 6.17 6.17.12-1.el9sat
- foreman-cli satellite utils 6.17, satellite 6.17 3.14.0.22-1.el9sat
- foreman-ec2 satellite 6.17 3.14.0.22-1.el9sat
- foreman-pcp satellite capsule 6.17, satellite 6.17 3.14.0.22-1.el9sat
- python-lxml satellite capsule 6.17, satellite 6.17 5.3.1-2.el9pc
- foreman-ovirt satellite 6.17 3.14.0.22-1.el9sat
- foreman-redis satellite 6.17 3.14.0.22-1.el9sat
red hat advisories RHSA-2026:74505RHSA-2026:74504RHSA-2026:74506RHSA-2026:74503RHSA-2026:71114RHSA-2026:71113
- python-sqlparse SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 0.4.4-150400.6.16.1
- python-sqlparse SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Python 3 15 SP7 +1 more 0.4.4-150600.3.9.1
- python3-sqlparse SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 0.4.2-150300.23.1
- python-sqlparse SLES for SAP applications 16.0, SLES 16.0 0.5.3-160000.4.1
- python-sqlparse SLE Module for Package Hub 15 SP7 0.2.4-150100.6.11.1
suse advisories SUSE-SU-2026:3910-1SUSE-SU-2026:3907-1SUSE-SU-2026:3906-1SUSE-SU-2026:23561-1SUSE-SU-2026:3762-1
- python-sqlparse openSUSE Leap 16.0 0.5.3-160000.4.1
- python-sqlparse openSUSE Tumbleweed 0.6.0-1.1
opensuse advisories openSUSE-SU-2026:21690-1openSUSE-SU-2026:11557-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-59893 updated cvss 7.5
sqlparse: sqlparse: Denial of Service via inefficient SQL parsing
-
Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-27/gateway-rhel9, ansible-automation-platform-24/controller-rhel8, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-24/eda-controller-rhel8, ansible-automation-platform-25/eda-controller-rhel8, +5 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 5 openshift5/ose-ironic-rhel9 Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-ec2-api, rhosp-rhel8/openstack-tempest, rhosp-rhel8/openstack-aodh-api, rhosp-rhel8/openstack-heat-all, rhosp-rhel8/openstack-heat-api, rhosp-rhel8/openstack-keystone, +76 more Red Hat OpenStack Platform 18.0 rhoso/openstack-horizon-rhel9, rhoso/openstack-aodh-api-rhel9, rhoso/openstack-heat-api-rhel9, rhoso/openstack-keystone-rhel9, rhoso/openstack-nova-api-rhel9, rhoso/openstack-aodh-base-rhel9, +60 more Red Hat Satellite 6 python-sqlparse, python3-sqlparseaffected: workaround, no fix available
-
Red Hat Update Infrastructure 4 for Cloud Providers python-sqlparseaffected: workaround, no fix planned “Will not fix”
-
Red Hat Update Infrastructure 5 rhui5/rhua-rhel9affected: workaround, no fix available
-
Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/bootc-automation-portal-rhel9 1791865660fixed: vendor fix RHSA-2026:82151
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1789606395, ansible-automation-platform-25/gateway-rhel8 1789605572, ansible-automation-platform-25/controller-rhel8 1789607021, ansible-automation-platform-25/lightspeed-rhel8 1789685837fixed: vendor fix RHSA-2026:71210
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-sqlparse 0.6.0-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9apfixed: vendor fix RHSA-2026:71114
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1789611274, ansible-automation-platform-26/gateway-rhel9 1789666472, ansible-automation-platform-26/controller-rhel9 1789673739, ansible-automation-platform-26/lightspeed-rhel9 1789656884, ansible-automation-platform-26/eda-controller-rhel9 1789653608, ansible-automation-platform-tech-preview/metrics-service-rhel9 1789654558fixed: vendor fix RHSA-2026:71179
show 14 moreshow fewer
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9ap Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-sqlparse 0.6.0-1.el10ap, python3-sqlparse 0.6.0-1.el10apfixed: vendor fix RHSA-2026:71113
-
Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1789572632, ansible-automation-platform-27/controller-rhel9 1791253059, ansible-automation-platform-27/lightspeed-rhel9 1788916677, ansible-automation-platform-27/eda-controller-rhel9 1788917355, ansible-automation-platform-27/metrics-service-rhel9 1788917058fixed: vendor fix RHSA-2026:79378
-
Red Hat Ansible Automation Platform 2.7 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9ap Red Hat Ansible Automation Platform 2.7 for RHEL 10 python-sqlparse 0.6.0-1.el10ap, python3-sqlparse 0.6.0-1.el10apfixed: vendor fix RHSA-2026:71112
-
Red Hat Discovery 2 discovery/discovery-server-rhel9 1788205779fixed: vendor fix RHSA-2026:61783
-
Red Hat OpenShift AI 3.4 rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-th06-cpu-torch210-py312-rhel9 1791874335, rhoai/odh-th06-rocm64-torch291-py312-rhel9 1791872119, rhoai/odh-th06-cuda130-torch210-py312-rhel9 1791961113, rhoai/odh-training-cuda128-torch29-py312-rhel9 1791786619, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1791829182, +13 morefixed: vendor fix RHSA-2026:84734
-
Red Hat OpenShift AI 3.5 rhoai/odh-mlflow-rhel9 1791947857, rhoai/odh-th-torch-cpu-py312-rhel9 1791926611, rhoai/odh-th-torch-cuda-py312-rhel9 1791927642, rhoai/odh-th-torch-rocm-py312-rhel9 1791925861, rhoai/odh-training-cuda128-torch29-py312-rhel9 1789529851, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1791816462, +13 morefixed: vendor fix RHSA-2026:86891
-
Red Hat Satellite 6.16 for RHEL 8 python-sqlparse 0.6.0-1.el8pc, python3.11-sqlparse 0.6.0-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-sqlparse 0.6.0-1.el9pc, python3.11-sqlparse 0.6.0-1.el9pcfixed: vendor fix RHSA-2026:74506
-
Red Hat Satellite 6.17 for RHEL 9 python-sqlparse 0.6.0-1.el9pc, python3.11-sqlparse 0.6.0-1.el9pcfixed: vendor fix RHSA-2026:74505
-
Red Hat Satellite 6.18 satellite/iop-advisor-backend-rhel9 1789666499fixed: vendor fix RHSA-2026:74643
-
Red Hat Satellite 6.18 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9pcfixed: vendor fix RHSA-2026:74504
-
Red Hat Satellite 6.19 satellite/iop-advisor-backend-rhel9 1789666498fixed: vendor fix RHSA-2026:74648
-
Red Hat Satellite 6.19 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9pcfixed: vendor fix RHSA-2026:74503
-
Red Hat Ansible Automation Platform 2 python3x-sqlparse 0.5.0-1.el8ap, python3.11-sqlparse 0.5.3-2.el9apnot affected: vulnerable code not in execute path
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-web-rhel8 1789690469, ansible-automation-platform-25/receptor-rhel8 1789590330, ansible-automation-platform-25/de-minimal-rhel8 1789634812, ansible-automation-platform-25/ee-minimal-rhel8 1789652412, ansible-automation-platform-25/de-supported-rhel8 1789638875, ansible-automation-platform-25/ee-supported-rhel8 1789633050, +17 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.8-1.el8ap, receptorctl 1.6.8-1.el8ap, automation-hub 4.10.19-1.el8ap, python3.12-gitpython 3.1.60-1.el8ap, automation-controller 4.6.33-1.el8ap, python3.12-galaxy-ng 4.10.19-1.el8ap, +14 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.10.19-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.6.33-1.el9ap, python3.12-galaxy-ng 4.10.19-1.el9ap, +14 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-web-rhel9 1789615881, ansible-automation-platform-26/receptor-rhel9 1789610120, ansible-automation-platform-26/mcp-tools-rhel9 1789609282, ansible-automation-platform-26/de-minimal-rhel9 1789658734, ansible-automation-platform-26/ee-minimal-rhel9 1789654312, ansible-automation-platform-26/de-supported-rhel9 1789661423, +19 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.11.14-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.7.17-1.el9ap, python3.12-galaxy-ng 4.11.14-1.el9ap, +28 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.8-1.el10ap, receptorctl 1.6.8-1.el10apnot affected: vulnerable code not present
+6 more productsfewer
Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1788918708, ansible-automation-platform-27/hub-rhel9 1791254555, ansible-automation-platform-27/gateway-rhel9 1788918510, ansible-automation-platform-27/gateway-rhel9 1789579764, ansible-automation-platform-27/gateway-rhel9 1791257377, ansible-automation-platform-27/hub-web-rhel9 1788924567, +86 more Red Hat Ansible Automation Platform 2.7 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-controller-cli 4.8.9-1.el9ap Red Hat Ansible Automation Platform 2.7 for RHEL 10 receptor 1.6.8-1.el10ap, receptorctl 1.6.8-1.el10ap, automation-controller-cli 4.8.9-1.el10ap Red Hat Discovery 2 discovery/discovery-ui-rhel9 1788206196 Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-trainer-rhel9 1791869783, rhoai/odh-eval-hub-rhel9 1791852583, +81 more Red Hat OpenShift AI 3.5 rhoai/odh-cli-rhel9 1789525149, rhoai/odh-cli-rhel9 1791945905, rhoai/rhai-cli-rhel9 1789525149, rhoai/rhai-cli-rhel9 1791945905, rhoai/odh-automl-rhel9 1789363166, rhoai/odh-automl-rhel9 1791916705, +213 more
11 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | sqlparse | <0.6.0 |
0.6.0 |
Affected products
- andialbrecht sqlparse
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e
web
-
github.com
/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr
exploit, web
-
github.com
/andialbrecht/sqlparse
package
-
pypi.org
/project/sqlparse
package
-
github.com
/advisories/GHSA-prg7-hcfm-mfcr
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-59893
advisory
Sources
- CVE List CVE-2026-59893
- GitHub Advisory GHSA-prg7-hcfm-mfcr
- NVD CVE-2026-59893
- OSV PYSEC-2026-3698
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.