CVE-2026-71491: 
Python vulnerability analysis and mitigation

CVE-2026-71491 is a Denial of Service vulnerability in the Python sqlparse library caused by quadratic O(n²) CPU consumption in the group_comments function. It affects all versions of sqlparse up to and including 0.5.5, and was disclosed on August 10, 2026, with the GitHub Advisory Database entry updated on August 17, 2026. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) (Github Advisory, GitHub Security Advisory).

The root cause is an inefficient algorithm (CWE-407) leading to uncontrolled resource consumption (CWE-400) in sqlparse/engine/grouping.py within the group_comments function (lines 331–341). When processing a statement composed entirely of single-line comments (-- c\n repeated), the while loop iterates n times and each iteration calls token_next_by and token_not_matching, both of which rescan the O(n) remaining token list — resulting in O(n²) total work. Critically, group_comments is invoked first in group() (line 439), before the MAX_GROUPING_TOKENS guard, meaning the quadratic cost is incurred even on oversized inputs that would otherwise be rejected. The vulnerability is reachable via both sqlparse.parse() and sqlparse.format(sql, strip_comments=True), the latter being widely used in query loggers, SQL firewalls, ORMs, and migration tools (Github Advisory, GitHub Security Advisory).

Successful exploitation causes excessive CPU consumption on the host running sqlparse, resulting in application hangs or severe performance degradation — a pure availability impact with no confidentiality or integrity consequences. A ~250 KB comment-only payload (e.g., '-- c\n' repeated ~4,000 times) can force minutes of CPU processing regardless of the 10,000-token cap, and the attack is automatable and requires no authentication. Applications that expose SQL parsing or formatting functionality to untrusted input — including web-facing ORMs, query loggers, and SQL firewalls — are at highest risk of service disruption (Github Advisory).

No public proof-of-concept exploit code has been released beyond the timing benchmark included in the advisory itself, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is unauthenticated, network-reachable, and requires no user interaction, making it highly automatable. The EPSS score is 0.0 and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Identify target: Locate an application that accepts user-controlled SQL input and processes it with sqlparse version ≤ 0.5.5 — common in web applications using Django, SQLAlchemy, or custom query loggers that call sqlparse.parse() or sqlparse.format(sql, strip_comments=True).
2. Craft payload: Construct a comment-only SQL string by repeating the single-line comment token -- c\n a large number of times (e.g., 4,000–10,000 repetitions, yielding a ~250 KB payload).
3. Submit payload: Send the crafted payload to the target application's SQL input endpoint (e.g., a query field, API parameter, or form input that feeds into sqlparse processing).
4. Trigger DoS: The application invokes sqlparse.parse() or sqlparse.format(sql, strip_comments=True), causing group_comments to perform O(n²) token rescanning, consuming excessive CPU and causing the process to hang or become unresponsive for an extended period.
5. Repeat for sustained DoS: Send multiple concurrent or sequential requests with the payload to maintain CPU saturation and prevent service recovery (Github Advisory, GitHub Security Advisory).

• Network: Repeated HTTP requests containing large SQL payloads (≥50 KB) composed predominantly of -- comment sequences submitted to SQL input endpoints.
• Process: Python worker processes (e.g., gunicorn, uwsgi, celery) showing sustained near-100% CPU utilization with no corresponding database activity; processes stuck in sqlparse.format or sqlparse.parse call stacks visible via py-spy or similar profilers.
• Logs: Application logs showing request timeouts or worker process restarts correlated with large SQL input submissions; web server logs showing unusually large POST body sizes to SQL-handling endpoints.
• File System: No file system artifacts expected for this DoS-only vulnerability.

The primary remediation is to upgrade sqlparse to version 0.6.0, which fixes the quadratic behavior by breaking out of the group_comments loop early when no terminator token is found, reducing complexity to O(n) (GitHub Commit). As interim workarounds, implement input size limits (e.g., reject SQL inputs exceeding a defined byte threshold) and configure request timeouts on SQL parsing operations to bound the impact of malicious input. Additionally, restrict access to SQL parsing functionality from untrusted or unauthenticated users where architecturally feasible (Github Advisory).