CVE-2026-71491

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71491
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-71491.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-71491
Aliases
Downstream
CGA (120)
CLEANSTART (5)
DEBIAN (1)
ECHO (1)
MINI (5)
OESA (2)
openSUSE (2)
RHSA (6)
ROOT (1)
SUSE (5)
UBUNTU (1)
Related
openSUSE (2)
SUSE (5)
Published
2026-08-17T17:16:48Z
Modified
2026-10-16T02:37:27Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
sqlparse: Quadratic O(n²) DoS in group_comments
Details

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-407"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71491.json"
}
References

Affected packages

Git / github.com/andialbrecht/sqlparse

Affected ranges

Type
GIT
Repo
https://github.com/andialbrecht/sqlparse
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2f40da99b50d81135aecf96f6b08fcfa338a96de
Fixed
ef2012a5eeb491e604dea2b00d516904a3830c87
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.6.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "ef2012a5eeb491e604dea2b00d516904a3830c87"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.2
0.1.3
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-71491.json"