CVE-2026-59893

Inefficient regex in sqlparse allows a Denial of Service via crafted SQL.

• CVSS 7.5
• 1333
• Resource Management
• Remote

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

CVE

CVE-2026-59893

CWE

1333

CVSS base score

7.5

Published

2026-08-17

OWASP

A04 Insecure Design

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

sqlparse

Fixed by upgrading

Yes

Solution

Upgrade `sqlparse` to version 0.6.0 or later.

import re
from sqlparse import tokens as T


class Lexer:
    """Simplified representation of the sqlparse.lexer.Lexer class."""

    # VULNERABLE: Inefficient regex using `.*?` leads to quadratic backtracking (ReDoS).
    SQL_REGEX = [
        (r'/\*[\s\S]*?\*/', T.Comment.Multiline),
        (r'(\$[a-zA-Z_]*\$).*?(\1)', T.Literal.String.Dollar),
        (r'(--|#).*?(\r\n|\r|\n|$)', T.Comment.Single),
        (r"'(?:''|[^'])*'", T.String.Single),
        (r"([a-zA-Z_][a-zA-Z0-9_]*)", T.Name),
        (r"([0-9]+)", T.Number.Integer),
        (r"([\.,;])", T.Punctuation),
        (r"([<>=!~^|&+-])", T.Operator),
    ]

    def __init__(self):
        """Compiles the regexes."""
        self.callbacks = [
            (re.compile(regex, re.IGNORECASE | re.DOTALL), token)
            for regex, token in self.SQL_REGEX
        ]

import re
from sqlparse import tokens as T


class Lexer:
    """Simplified representation of the sqlparse.lexer.Lexer class."""

    # FIX: Use a more specific pattern to prevent excessive backtracking.
    SQL_REGEX = [
        (r'/\*(?:[^*]|\*(?!/))*?\*/', T.Comment.Multiline),
        (r'(\$[a-zA-Z_]*\$)(?:[^\$]|\$(?!\1))*?(\1)', T.Literal.String.Dollar),
        (r'(--|#).*?(\r\n|\r|\n|$)', T.Comment.Single),
        (r"'(?:''|[^'])*'", T.String.Single),
        (r"([a-zA-Z_][a-zA-Z0-9_]*)", T.Name),
        (r"([0-9]+)", T.Number.Integer),
        (r"([\.,;])", T.Punctuation),
        (r"([<>=!~^|&+-])", T.Operator),
    ]

    def __init__(self):
        """Compiles the regexes."""
        self.callbacks = [
            (re.compile(regex, re.IGNORECASE | re.DOTALL), token)
            for regex, token in self.SQL_REGEX
        ]

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202659893,
  title        = {{Inefficient regex in sqlparse allows a Denial of Service via crafted SQL.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-59893},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-59893/}}
}