SUSE-SU-2026:3762-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:3762-1

Upstream

CVE (4)

Related

CVE (4)

Published

2026-08-24T18:24:43Z

Modified

2026-08-26T18:23:34Z

Summary

Security update for python-sqlparse

Details

This update for python-sqlparse fixes the following issues:

CVE-2026-54284: TokenList.init materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger (bsc#1275459).
CVE-2026-59893: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (bsc#1275461).
CVE-2026-59894: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes (bsc#1275460).
CVE-2026-71491: quadratic O(n2) DoS in group_comments (bsc#1275466).

References

Affected packages

Name: python-sqlparse
Purl: pkg:rpm/suse/python-sqlparse&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.2.4-150100.6.11.1

{
    "binaries":  [
        {
            "python2-sqlparse":  "0.2.4-150100.6.11.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3762-1.json"