CVE-2026-71491 sqlparse vulnerability allows for high CPU consumption through repeated rescanning of comment-only statements prior to version 0.6.0. This issue is fixed in version 0.6.0. The vulnerability impacts Python applications using the sqlparse module, allowing for potential high CPU consumption attacks. Defenders should assess exposure and prioritize upgrading to version 0.6.0 or later. The issue [truncated]
CVE-2026-59894 sqlparse Injection Vulnerability: The sqlparse module for Python, prior to version 0.6.0, fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php'. This allows crafted SQL to terminate the generated string and inject Python or PHP code. Developers and security teams using sqlparse in Python projects should assess their exposure and [truncated]
CVE-2026-59893 sqlparse Quadratic CPU Consumption: The sqlparse Python module, prior to version 0.6.0, contains a vulnerability that can lead to quadratic CPU consumption. This occurs because the SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters. This issue can be triggered through functions lik [truncated]
CVE-2026-54284 sqlparse vulnerability allows for quadratic CPU consumption through repeated flattening of nested token subtrees. This issue is fixed in version 0.6.0. The vulnerability affects Python applications using the sqlparse library, potentially leading to CPU consumption issues. Defenders should assess exposure and prioritize upgrading to version 0.6.0 or later. The CVE record and NVD entry provid [truncated]
