{"uuid": "4984e301-1bb3-4f11-9503-e6b64f5eda2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59893", "type": "seen", "source": "https://gist.github.com/alon710/dfd35d68fb93e084af258814e55849da", "content": "# CVE-2026-59893: CVE-2026-59893: Regular Expression Denial of Service in sqlparse Lexer\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59893\n\n## Summary\nA high-severity Regular Expression Denial of Service (ReDoS) vulnerability in the sqlparse Python library prior to version 0.6.0 allows unauthenticated remote attackers to trigger CPU exhaustion and application denial of service via crafted SQL inputs containing unmatched dollar-quoted literals or unclosed multiline comments.\n\n## TL;DR\nsqlparse prior to 0.6.0 is vulnerable to O(N^2) CPU exhaustion (ReDoS) when processing SQL strings with unmatched PostgreSQL dollar-quoted tags or unclosed multiline comments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1333\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **Affected Component**: Lexer Engine (sqlparse/keywords.py)\n- **Vulnerability Class**: Regular Expression Denial of Service (ReDoS)\n\n## Affected Systems\n\n- sqlparse (Python module)\n- **sqlparse**: < 0.6.0 (Fixed in: `0.6.0`)\n\n## Mitigation\n\n- Upgrade sqlparse library to version 0.6.0 or newer.\n- Implement maximum length constraints on untrusted SQL input fields.\n- Deploy WAF rules to detect and drop payloads with repeated unmatched delimiters.\n\n**Remediation Steps:**\n1. Audit Python dependencies to identify environments using sqlparse prior to 0.6.0.\n2. Update requirements.txt, Pipfile, or poetry.lock to require sqlparse>=0.6.0.\n3. Rebuild and deploy the updated application code to production.\n\n## References\n\n- [GitHub Commit Fix](https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e)\n- [GitHub Security Advisory](https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr)\n- [CVE Official Record](https://www.cve.org/CVERecord?id=CVE-2026-59893)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59893) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-17T21:32:25.639912Z"}