sqlparse has 7 CVEs on record between 2021 and 2026. 4 were published in the last 90 days. The busiest recent month was August 2026 with 3. The median CVSS is 7.5 (high). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Weakness classes
Products
- sqlparse 7
Worst active — by depth score
CVE-2024-4340High· 7.5sqlparse parsing heavily nested list leads to Denial of Service42CVE-2021-32839High· 7.5StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)42CVE-2026-59893High· 7.5sqlparse is a non-validating SQL parser module for Python41CVE-2026-54284High· 7.5sqlparse is a non-validating SQL parser module for Python41CVE-2026-84305Mediumsqlparse is a non-validating SQL parser module for Python28
sqlparse vulnerabilities
CVEs affecting sqlparse, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-84305Mediumsqlparse is a non-validating SQL parser module for Python
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/…
CVE-2026-59894Mediumsqlparse is a non-validating SQL parser module for Python
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the correspond…
CVE-2026-54284High· 7.5sqlparse is a non-validating SQL parser module for Python
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing …
CVE-2026-59893High· 7.5sqlparse is a non-validating SQL parser module for Python
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters,…
GHSA-27jp-wm6q-gp25Mediumsqlparse: formatting list of tuples leads to denial of service
sqlparse: formatting list of tuples leads to denial of service
CVE-2024-4340High· 7.5sqlparse parsing heavily nested list leads to Denial of Service
sqlparse parsing heavily nested list leads to Denial of Service
CVE-2021-32839High· 7.5StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)
StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)