CVE-2026-59893: Regular Expression Denial of Service in sqlparse Lexer

Vulnerability ID: CVE-2026-59893
CVSS Score: 7.5
Published: 2026-08-17

A high-severity Regular Expression Denial of Service (ReDoS) vulnerability in the sqlparse Python library prior to version 0.6.0 allows unauthenticated remote attackers to trigger CPU exhaustion and application denial of service via crafted SQL inputs containing unmatched dollar-quoted literals or unclosed multiline comments.

TL;DR

sqlparse prior to 0.6.0 is vulnerable to O(N^2) CPU exhaustion (ReDoS) when processing SQL strings with unmatched PostgreSQL dollar-quoted tags or unclosed multiline comments.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-1333
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 7.5 (High)
Exploit Status: Proof-of-Concept Available
Affected Component: Lexer Engine (sqlparse/keywords.py)
Vulnerability Class: Regular Expression Denial of Service (ReDoS)

Affected Systems

sqlparse (Python module)
sqlparse: < 0.6.0 (Fixed in: 0.6.0)

Code Analysis

Commit: d1d8060

Fix uncontrolled CPU consumption (ReDoS) in the lexer's handling of dollar-quoted literals and multiline comments.

--- a/sqlparse/keywords.py
+++ b/sqlparse/keywords.py

Exploit Details

GitHub Security Advisory: Advisory containing PoC reproduction steps for unmatched dollar-quote tokens and multiline comments.

Mitigation Strategies

Upgrade sqlparse library to version 0.6.0 or newer.
Implement maximum length constraints on untrusted SQL input fields.
Deploy WAF rules to detect and drop payloads with repeated unmatched delimiters.

Remediation Steps:

Audit Python dependencies to identify environments using sqlparse prior to 0.6.0.
Update requirements.txt, Pipfile, or poetry.lock to require sqlparse>=0.6.0.
Rebuild and deploy the updated application code to production.