Vulnerabilities for sqlparse

First version without a known vulnerability: 0.6.0

Details

• GHSA-prg7-hcfm-mfcr2026-08-17

  sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

  Fixed in: 0.6.0

• GHSA-pwgv-4x5q-6m9f2026-08-17

  sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

  Fixed in: 0.6.0

• GHSA-f2ff-p2ww-7p4p2026-08-17

  sqlparse: Quadratic O(n²) DoS in group_comments

  Fixed in: 0.6.0

• GHSA-3496-9g83-7v6x2026-08-17

  sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

  Fixed in: 0.6.0

• GHSA-27jp-wm6q-gp252026-02-13

  sqlparse: formatting list of tuples leads to denial of service

  Fixed in: 0.5.4

• GHSA-2m57-hf25-phgg2024-04-15

  sqlparse parsing heavily nested list leads to Denial of Service

  Fixed in: 0.5.0

• GHSA-rrm6-wvj7-cwh22023-04-21

  sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service

  Fixed in: 0.4.4, c457abd5f097dd13fb21543381e7cfafe7d31cfb, e75e35869473832a1eb67772b1adfee2db11b85a

• GHSA-p5w8-wqhj-9hhf2021-09-10

  StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)

  Fixed in: 0.4.2, 8238a9e450ed1524e40cb3a8b0b3c00606903aeb