CVE-2026-71491 json
sqlparse: Quadratic O(n²) DoS in group_comments
published 2026-08-17 2 mo ago modified 2026-10-23 16 d ago also GHSA-f2ff-p2ww-7p4p , PYSEC-2026-3697 , EUVD-2026-60309
- cvss
- 8.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.
Patch / fix
- pypi sqlparse 0.6.0
- sqlparse Ubuntu 22.04 LTS 0.4.2-1ubuntu0.22.04.3
- sqlparse Ubuntu 24.04 LTS 0.4.4-1ubuntu0.2
- sqlparse Ubuntu 26.04 LTS 0.5.4-1ubuntu0.1
- sqlparse Ubuntu Pro 16.04 LTS 0.1.18-1ubuntu0.1~esm1
- sqlparse Ubuntu Pro 18.04 LTS 0.2.4-0.1ubuntu0.1+esm1
- sqlparse Ubuntu Pro 20.04 LTS 0.2.4-3ubuntu0.1+esm1
ubuntu advisories UBUNTU-CVE-2026-71491
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- foreman satellite utils 6.17, satellite capsule 6.17, satellite 6.17 3.14.0.22-1.el9sat
- satellite satellite utils 6.17, satellite capsule 6.17, satellite 6.17 6.17.12-1.el9sat
- foreman-cli satellite utils 6.17, satellite 6.17 3.14.0.22-1.el9sat
- foreman-ec2 satellite 6.17 3.14.0.22-1.el9sat
- foreman-pcp satellite capsule 6.17, satellite 6.17 3.14.0.22-1.el9sat
- python-lxml satellite capsule 6.17, satellite 6.17 5.3.1-2.el9pc
- foreman-ovirt satellite 6.17 3.14.0.22-1.el9sat
- foreman-redis satellite 6.17 3.14.0.22-1.el9sat
red hat advisories RHSA-2026:74505RHSA-2026:74504RHSA-2026:74503RHSA-2026:71114RHSA-2026:71113RHSA-2026:71112
- python-sqlparse SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 0.4.4-150400.6.16.1
- python-sqlparse SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Python 3 15 SP7 +1 more 0.4.4-150600.3.9.1
- python3-sqlparse SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 0.4.2-150300.23.1
- python-sqlparse SLES for SAP applications 16.0, SLES 16.0 0.5.3-160000.4.1
- python-sqlparse SLE Module for Package Hub 15 SP7 0.2.4-150100.6.11.1
suse advisories SUSE-SU-2026:3910-1SUSE-SU-2026:3907-1SUSE-SU-2026:3906-1SUSE-SU-2026:23561-1SUSE-SU-2026:3762-1
- python-sqlparse openSUSE Leap 16.0 0.5.3-160000.4.1
- python-sqlparse openSUSE Tumbleweed 0.6.0-1.1
opensuse advisories openSUSE-SU-2026:21690-1openSUSE-SU-2026:11557-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-71491 updated cvss 7.5
sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping
-
Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-24/controller-rhel8, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/controller-rhel8, ansible-automation-platform-26/controller-rhel9, +7 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 openshift4/ose-ironic-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-ironic-rhel9 Red Hat OpenStack Platform 16.2 rhosp-rhel8/openstack-ec2-api, rhosp-rhel8/openstack-tempest, rhosp-rhel8/openstack-aodh-api, rhosp-rhel8/openstack-heat-all, rhosp-rhel8/openstack-heat-api, rhosp-rhel8/openstack-keystone, +76 more Red Hat OpenStack Platform 17.1 rhosp-rhel9/openstack-horizon, rhosp-rhel9/openstack-tempest, rhosp-rhel9/openstack-aodh-api, rhosp-rhel9/openstack-heat-all, rhosp-rhel9/openstack-heat-api, rhosp-rhel9/openstack-keystone, +69 moreaffected: workaround, no fix available
-
Red Hat OpenStack Platform 18.0 python-sqlparse, rhoso/openstack-horizon-rhel9, rhoso/openstack-aodh-api-rhel9, rhoso/openstack-heat-api-rhel9, rhoso/openstack-keystone-rhel9, rhoso/openstack-nova-api-rhel9, +61 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Update Infrastructure 4 for Cloud Providers python-sqlparseaffected: workaround, no fix planned “Will not fix”
-
Red Hat Update Infrastructure 5 rhui5/rhua-rhel9affected: workaround, no fix available
-
Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/bootc-automation-portal-rhel9 1791865660fixed: vendor fix RHSA-2026:82151
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1789606395, ansible-automation-platform-25/gateway-rhel8 1789605572, ansible-automation-platform-25/lightspeed-rhel8 1789685837fixed: vendor fix RHSA-2026:71210
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-sqlparse 0.6.0-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9apfixed: vendor fix RHSA-2026:71114
show 14 moreshow fewer
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1789611274, ansible-automation-platform-26/gateway-rhel9 1789666472, ansible-automation-platform-26/lightspeed-rhel9 1789656884, ansible-automation-platform-26/eda-controller-rhel9 1789653608, ansible-automation-platform-tech-preview/metrics-service-rhel9 1789654558fixed: vendor fix RHSA-2026:71179
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9ap Red Hat Ansible Automation Platform 2.6 for RHEL 10 python-sqlparse 0.6.0-1.el10ap, python3-sqlparse 0.6.0-1.el10apfixed: vendor fix RHSA-2026:71113
-
Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1789572632, ansible-automation-platform-27/gateway-rhel9 1788918510, ansible-automation-platform-27/lightspeed-rhel9 1788916677, ansible-automation-platform-27/eda-controller-rhel9 1788917355, ansible-automation-platform-27/metrics-service-rhel9 1788917058fixed: vendor fix RHSA-2026:67279
-
Red Hat Ansible Automation Platform 2.7 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9ap Red Hat Ansible Automation Platform 2.7 for RHEL 10 python-sqlparse 0.6.0-1.el10ap, python3-sqlparse 0.6.0-1.el10apfixed: vendor fix RHSA-2026:71112
-
Red Hat Discovery 2 discovery/discovery-server-rhel9 1788205779, discovery/discovery-server-rhel9 1789675186fixed: vendor fix RHSA-2026:61783
-
Red Hat OpenShift AI 3.4 rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-th06-cpu-torch210-py312-rhel9 1791874335, rhoai/odh-th06-rocm64-torch291-py312-rhel9 1791872119, rhoai/odh-th06-cuda130-torch210-py312-rhel9 1791961113, rhoai/odh-training-cuda128-torch29-py312-rhel9 1791786619, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1791829182, +13 morefixed: vendor fix RHSA-2026:84734
-
Red Hat OpenShift AI 3.5 rhoai/odh-mlflow-rhel9 1791947857, rhoai/odh-th-torch-cpu-py312-rhel9 1791926611, rhoai/odh-th-torch-cuda-py312-rhel9 1791927642, rhoai/odh-th-torch-rocm-py312-rhel9 1791925861, rhoai/odh-training-cuda128-torch29-py312-rhel9 1789529851, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1791816462, +13 morefixed: vendor fix RHSA-2026:86891
-
Red Hat Satellite 6.17 for RHEL 9 python-sqlparse 0.6.0-1.el9pc, python3.11-sqlparse 0.6.0-1.el9pcfixed: vendor fix RHSA-2026:74505
-
Red Hat Satellite 6.18 satellite/iop-advisor-backend-rhel9 1789666499fixed: vendor fix RHSA-2026:74643
-
Red Hat Satellite 6.18 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9pcfixed: vendor fix RHSA-2026:74504
-
Red Hat Satellite 6.19 satellite/iop-advisor-backend-rhel9 1789666498fixed: vendor fix RHSA-2026:74648
-
Red Hat Satellite 6.19 for RHEL 9 python3.12-sqlparse 0.6.0-1.el9pcfixed: vendor fix RHSA-2026:74503
-
Red Hat Ansible Automation Platform 2 python3x-sqlparse 0.5.0-1.el8ap, python3.11-sqlparse 0.5.3-2.el9ap, ansible-automation-platform-24/eda-controller-rhel8 Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-web-rhel8 1789690469, ansible-automation-platform-25/receptor-rhel8 1789590330, ansible-automation-platform-25/controller-rhel8 1789607021, ansible-automation-platform-25/de-minimal-rhel8 1789634812, ansible-automation-platform-25/ee-minimal-rhel8 1789652412, ansible-automation-platform-25/de-supported-rhel8 1789638875, +18 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.8-1.el8ap, receptorctl 1.6.8-1.el8ap, automation-hub 4.10.19-1.el8ap, python3.12-gitpython 3.1.60-1.el8ap, automation-controller 4.6.33-1.el8ap, python3.12-galaxy-ng 4.10.19-1.el8ap, +14 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.10.19-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.6.33-1.el9ap, python3.12-galaxy-ng 4.10.19-1.el9ap, +14 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-web-rhel9 1789615881, ansible-automation-platform-26/receptor-rhel9 1789610120, ansible-automation-platform-26/mcp-tools-rhel9 1789609282, ansible-automation-platform-26/controller-rhel9 1789673739, ansible-automation-platform-26/de-minimal-rhel9 1789658734, ansible-automation-platform-26/ee-minimal-rhel9 1789654312, +20 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-hub 4.11.14-1.el9ap, python3.12-gitpython 3.1.60-1.el9ap, automation-controller 4.7.17-1.el9ap, python3.12-galaxy-ng 4.11.14-1.el9ap, +28 morenot affected: vulnerable code not present
+7 more productsfewer
Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.8-1.el10ap, receptorctl 1.6.8-1.el10ap Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1788918708, ansible-automation-platform-27/gateway-rhel9 1789579764, ansible-automation-platform-27/hub-web-rhel9 1788924567, ansible-automation-platform-27/hub-web-rhel9 1789575016, ansible-automation-platform-27/receptor-rhel9 1788918370, ansible-automation-platform-27/receptor-rhel9 1789519651, +53 more Red Hat Ansible Automation Platform 2.7 for RHEL 9 receptor 1.6.8-1.el9ap, receptorctl 1.6.8-1.el9ap, automation-controller-cli 4.8.9-1.el9ap Red Hat Ansible Automation Platform 2.7 for RHEL 10 receptor 1.6.8-1.el10ap, receptorctl 1.6.8-1.el10ap, automation-controller-cli 4.8.9-1.el10ap Red Hat Discovery 2 discovery/discovery-ui-rhel9 1788206196, discovery/discovery-ui-rhel9 1789677459 Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-trainer-rhel9 1791869783, rhoai/odh-eval-hub-rhel9 1791852583, +81 more Red Hat OpenShift AI 3.5 rhoai/odh-cli-rhel9 1789525149, rhoai/odh-cli-rhel9 1791945905, rhoai/rhai-cli-rhel9 1789525149, rhoai/rhai-cli-rhel9 1791945905, rhoai/odh-automl-rhel9 1789363166, rhoai/odh-automl-rhel9 1791916705, +213 more -
Red Hat OpenShift Container Platform 4 python2-sqlparse, python3-sqlparse, openshift4/ose-kuryr-cni-rhel8, openshift4/ose-kuryr-controller-rhel8not affected: vulnerable code not in execute path
8 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | sqlparse | <0.6.0 |
0.6.0 |
Affected products
- andialbrecht sqlparse
Classification
References
-
github.com
/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87
web
-
github.com
/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p
web
-
github.com
/andialbrecht/sqlparse
package
-
pypi.org
/project/sqlparse
package
-
github.com
/advisories/GHSA-f2ff-p2ww-7p4p
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-71491
advisory
Sources
- CVE List CVE-2026-71491
- GitHub Advisory GHSA-f2ff-p2ww-7p4p
- NVD CVE-2026-71491
- OSV PYSEC-2026-3697
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.