CVE-2026-71491: sqlparse Python Module DOS Vulnerability

CVE-2026-71491 Overview

CVE-2026-71491 is a denial-of-service vulnerability in sqlparse, a non-validating SQL parser module for Python. Versions prior to 0.6.0 contain an algorithmic complexity flaw in the group_comments function within sqlparse/engine/grouping.py. The function repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard applies, producing quadratic CPU consumption. Attackers reach the vulnerable path through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). The issue is fixed in version 0.6.0.

Critical Impact
Remote unauthenticated attackers can submit comment-only SQL input to consume CPU quadratically, degrading availability of any Python service that invokes sqlparse on untrusted input.

Affected Products

sqlparse Python package versions prior to 0.6.0
Applications calling sqlparse.parse() on untrusted SQL input
Applications calling sqlparse.format(sql, strip_comments=True) on untrusted SQL input

Discovery Timeline

Vulnerability reported by sanktjodel (per the project CHANGELOG)
2026-08-17 - CVE-2026-71491 published to NVD
2026-08-17 - Last updated in NVD database

Technical Details for CVE-2026-71491

Vulnerability Analysis

The defect is an algorithmic complexity flaw classified under [CWE-400] Uncontrolled Resource Consumption. Lexing a comment-only statement composed of n single-line comments completes in O(n). The group_comments routine then rescans the remaining O(n) tokens for every comment token encountered, producing O(n²) total work. Because group_comments executes early in group(), it runs before the MAX_GROUPING_TOKENS guard that would otherwise cap grouping cost. The token cap therefore provides no protection against this input shape.

Root Cause

The group_comments implementation in sqlparse/engine/grouping.py restarts its token scan on each comment match instead of advancing from the last processed offset. Comment-only payloads maximize the scan cost per iteration, forcing repeated traversal of the same tail. The absence of an upstream token-count guard for this specific pass means an attacker controls the outer loop bound directly through input length.

Attack Vector

An unauthenticated network attacker submits a SQL payload consisting of repeated single-line comments, for example '-- c\n' repeated many times. Any application layer that forwards the payload into sqlparse.parse() or sqlparse.format(sql, strip_comments=True) will execute the quadratic path. Common exposure surfaces include SQL formatters, ORM tooling, database proxies, migration utilities, and web services that accept user-supplied SQL for parsing or display.

python

# Regression benchmark from the upstream patch
# Source: https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87

import sys
import time

import sqlparse


def payload(n):
    """A comment-only statement of n single-line comments."""
    return '-- c\n' * n

The benchmark script measures scaling of the vulnerable path and exits with code 1 when observed growth is quadratic, or 0 when growth is roughly linear after applying the fix.

Detection Methods for CVE-2026-71491

Indicators of Compromise

Sustained high CPU utilization in Python processes that invoke sqlparse shortly after receiving user-supplied SQL input.
Request logs containing SQL payloads dominated by repeated single-line comment tokens such as -- c\n.
Application response-time spikes or worker timeouts correlated with parse or format operations on submitted SQL.

Detection Strategies

Inventory dependencies for sqlparse versions below 0.6.0 using pip list or software composition analysis tooling.
Instrument calls to sqlparse.parse() and sqlparse.format() with input-size and wall-clock metrics to expose outliers.
Static-analyze application code for direct or transitive use of sqlparse against untrusted input paths.

Monitoring Recommendations

Track per-request CPU time for endpoints that accept SQL input and alert on statistical anomalies.
Log payload length and comment-token density to identify comment-heavy inputs before they reach the parser.
Set worker-level CPU and timeout limits so a single request cannot exhaust process capacity.

How to Mitigate CVE-2026-71491

Immediate Actions Required

Upgrade sqlparse to version 0.6.0 or later across all Python environments and container images.
Audit direct and transitive dependencies with pip show sqlparse and rebuild affected services.
Restrict or authenticate endpoints that pass user-controlled SQL into sqlparse until patching completes.

Patch Information

The fix is delivered in sqlparse 0.6.0. Upstream commit ef2012a restores linear scaling in group_comments for comment-only input. See the GitHub Security Advisory GHSA-f2ff-p2ww-7p4p for the coordinated disclosure record.

Workarounds

Enforce a maximum payload size on any input passed to sqlparse.parse() or sqlparse.format().
Reject or strip inputs consisting predominantly of SQL comment tokens before parser invocation.
Execute parsing under a hard CPU-time budget using process supervisors or per-request timeouts.

bash

# Upgrade sqlparse to the patched release
pip install --upgrade 'sqlparse>=0.6.0'

# Verify the installed version
python -c "import sqlparse; print(sqlparse.__version__)"