sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade python3.12-django-ansible-base+channel_authUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-django-ansible-base+authenticationUpgrade aap-metrics-utilityUpgrade receptorUpgrade automation-gateway-proxy-server-debuginfoUpgrade automation-eda-controller-baseUpgrade receptor-debuginfoUpgrade receptor-debugsourceUpgrade python3.12-django-ansible-base+redis_clientUpgrade automation-eda-controller-event-stream-servicesUpgrade python3.12-django-ansible-base+rbacUpgrade automation-gateway-proxy-serverUpgrade python3.12-django-ansible-base+api_documentationUpgrade python3.12-django-ansible-baseUpgrade automation-gateway-configUpgrade python3.12-django-ansible-base+feature_flagsUpgrade automation-eda-controller-base-servicesUpgrade automation-platform-uiUpgrade python3-sqlparseUpgrade automation-eda-controllerUpgrade python3.12-django-ansible-base+oauth2_providerUpgrade automation-gateway-proxy-debugsourceUpgrade automation-controller-serverUpgrade python3.12-galaxy-ngUpgrade automation-gatewayUpgrade automation-controller-venv-towerUpgrade python3.12-django-ansible-base+rest_filtersUpgrade automation-gateway-proxyUpgrade automation-controllerUpgrade automation-controller-uiUpgrade automation-eda-controller-worker-servicesUpgrade python3.12-sqlparseUpgrade python3.12-django-ansible-base+resource_registryUpgrade python3.12-gitpythonUpgrade automation-hubUpgrade automation-controller-cliUpgrade automation-gateway-serverUpgrade python3.12-django-ansible-base+activitystreamUpgrade receptorctl | Sep 25, 2026 | Aug 17, 2026 |
| Ubuntu | — | Upgrade python3-sqlparse (Ubuntu Pro)Upgrade python3-sqlparseUpgrade pypy-sqlparse (Ubuntu Pro)Upgrade python-sqlparse (Ubuntu Pro) | Sep 24, 2026 | Sep 23, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub