CVE-2026-71491

8.7

andialbrecht · sqlparse

The sqlparse Python module is susceptible to uncontrolled resource consumption and inefficient algorithmic complexity, which can be triggered by providing complex, malformed SQL queries.

Executive summary

The andialbrecht sqlparse library is affected by a high-severity vulnerability that allows unauthenticated attackers to cause a denial of service through uncontrolled resource consumption.

Vulnerability

This vulnerability involves inefficient algorithmic complexity and uncontrolled resource consumption, which allows an unauthenticated attacker to exhaust system resources by submitting specially crafted SQL inputs.

Business impact

Successful exploitation leads to a denial of service condition, disrupting applications that depend on the sqlparse module. With a CVSS score of 8.7, this vulnerability poses a high risk to operational continuity, as attackers can easily force the application to hang or crash by sending malicious payloads.

Remediation

Immediate Action: Update the sqlparse library to version 0.6.0 or higher immediately.

Proactive Monitoring: Review application logs for patterns indicating repeated or unusually long parsing requests and monitor CPU utilization for unexpected surges.

Compensating Controls: Deploy a Web Application Firewall (WAF) or input sanitization layer to block or truncate excessively complex or malformed SQL queries before they reach the parser.

Exploitation status

Public Exploit Available: Unknown

Analyst recommendation

Due to the ease of automation and the high severity of the potential denial of service, administrators must treat this as a high-priority update. Upgrading to version 0.6.0 is the only effective way to remediate the underlying algorithmic inefficiency.

More andialbrecht CVEs