andialbrecht vulnerabilities

Products

• sqlparse 7

Latest andialbrecht CVEs

Newest publication first

1. CVE-2026-84305 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

   Published 2026-09-01

   Medium·CVSS 5.1 EPSS 0.19%

   sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/filters/reindent.py, where _flatten_up_to_t...

2. CVE-2026-54284 sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

   Published 2026-08-17

   High·CVSS 8.7 EPSS 0.33%

   sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse....

3. CVE-2026-59893 sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

   Published 2026-08-17

   High·CVSS 7.5 EPSS 0.34%

   sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through...

4. CVE-2026-71491 sqlparse: Quadratic O(n²) DoS in group_comments

   Published 2026-08-17

   High·CVSS 8.7 EPSS 0.26%

   sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format...

5. CVE-2026-59894 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

   Published 2026-08-17

   Medium·CVSS 6.2 EPSS 0.13%

   sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQ...

6. CVE-2023-30608 Parser contains an inefficient regular expression in sqlparse

   Published 2023-04-18

   High·CVSS 7.5 EPSS 0.98%

   sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit e75e358. The vulnerability may lead to Denial of Se...

7. CVE-2021-32839 Regular Expression Denial of Service in sqlparse

   Published 2021-09-20

   High·CVSS 7.5 EPSS 2.3%

   sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Service in sqlparse vulnerability. The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.