Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

sqlparse

8 known vulnerabilities (5 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
0.6.1 (Nov 1, 2026): no advisory affects it
Newest unaffected release
0.6.1 (Nov 1, 2026), the latest release
Advisories
8 · 5 high, 3 medium
Weekly downloads
29.5M
Releases
40 since 0.1.0 (May 20, 2013)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • CVE-2026-84305Medium 5.1

    sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

    Affected: fixed in 0.6.0.

    Fixed in 0.6.0 (released Aug 13, 2026, 19 days before disclosure).

    The latest release, 0.6.1, is not affected.

  • sqlparse: TokenList.init materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

    Affected: fixed in 0.6.0.

    Fixed in 0.6.0 (released Aug 13, 2026, 4 days before disclosure).

    The latest release, 0.6.1, is not affected.

  • sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

    Affected: fixed in 0.6.0.

    Fixed in 0.6.0 (released Aug 13, 2026, 4 days before disclosure).

    The latest release, 0.6.1, is not affected.

  • sqlparse: Quadratic O(n²) DoS in group_comments

    Affected: fixed in 0.6.0.

    Fixed in 0.6.0 (released Aug 13, 2026, 4 days before disclosure).

    The latest release, 0.6.1, is not affected.

  • CVE-2026-59894Medium 6.2

    sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

    Affected: fixed in 0.6.0.

    Fixed in 0.6.0 (released Aug 13, 2026, 4 days before disclosure).

    The latest release, 0.6.1, is not affected.

  • Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.

    Affected: fixed in 0.5.0; fixed in 0.5.0.

    Fixed in 0.5.0 (released Apr 13, 2024, 17 days before disclosure).

    The latest release, 0.6.1, is not affected.

  • CVE-2023-30608Medium 5.5

    Parser contains an inefficient regular expression in sqlparse

    Affected: from 0.1.15, fixed in 0.4.4.

    Fixed in 0.4.4 (released Apr 18, 2023, the day of disclosure).

    The latest release, 0.6.1, is not affected.

  • Regular Expression Denial of Service in sqlparse

    Affected: from 0.4.0, fixed in 0.4.2.

    Fixed in 0.4.2 (released Sep 10, 2021, 10 days before disclosure).

    The latest release, 0.6.1, is not affected.