CVE-2026-59893: Regular Expression Denial of Service in sqlparse Lexer
Vulnerability ID: CVE-2026-59893
CVSS Score: 7.5
Published: 2026-08-17
A high-severity Regular Expression Denial of Service (ReDoS) vulnerability in the sqlparse Python library prior to version 0.6.0 allows unauthenticated remote attackers to trigger CPU exhaustion and application denial of service via crafted SQL inputs containing unmatched dollar-quoted literals or unclosed multiline comments.
TL;DR
sqlparse prior to 0.6.0 is vulnerable to O(N^2) CPU exhaustion (ReDoS) when processing SQL strings with unmatched PostgreSQL dollar-quoted tags or unclosed multiline comments.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-1333
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 7.5 (High)
- Exploit Status: Proof-of-Concept Available
- Affected Component: Lexer Engine (sqlparse/keywords.py)
- Vulnerability Class: Regular Expression Denial of Service (ReDoS)
Affected Systems
- sqlparse (Python module)
-
sqlparse: < 0.6.0 (Fixed in:
0.6.0)
Code Analysis
Commit: d1d8060
Fix uncontrolled CPU consumption (ReDoS) in the lexer's handling of dollar-quoted literals and multiline comments.
--- a/sqlparse/keywords.py
+++ b/sqlparse/keywords.py
Exploit Details
- GitHub Security Advisory: Advisory containing PoC reproduction steps for unmatched dollar-quote tokens and multiline comments.
Mitigation Strategies
- Upgrade sqlparse library to version 0.6.0 or newer.
- Implement maximum length constraints on untrusted SQL input fields.
- Deploy WAF rules to detect and drop payloads with repeated unmatched delimiters.
Remediation Steps:
- Audit Python dependencies to identify environments using sqlparse prior to 0.6.0.
- Update requirements.txt, Pipfile, or poetry.lock to require sqlparse>=0.6.0.
- Rebuild and deploy the updated application code to production.
References
Read the full report for CVE-2026-59893 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)