CVE-2026-71491: sqlparse: Quadratic O(n²) DoS in group_comments

August 17, 2026

A comment-only statement (-- c\n*n) may cause a Denial of Service (DoS).

References

github.com/advisories/GHSA-f2ff-p2ww-7p4p
github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87
github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p
nvd.nist.gov/vuln/detail/CVE-2026-71491

Code Behaviors & Features

Detect and mitigate CVE-2026-71491 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →