openSUSE Python-SQLParse Important Denial of Service Advisory 2026-3907

Back Linuxsecurity

openSUSE Python-SQLParse Important Denial of Service Advisory 2026-3907

Linuxsecurity •LinuxSecurity Advisories • September 1, 2026

Share: View original

Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×

This update for python-sqlparse fixes the following issues:

* CVE-2026-54284: high algorithm complexity when parsing SQL payloads with

hundreds of nesting levels can lead to denial of service via excessive

resource consumption (bsc#1275459).

* CVE-2026-59893: quadratic complexity when processing unmatched dollar-quoted

literal and multiline- delimiters can lead to denial of service

* CVE-2026-59894: improper backlash escaping allows for injection of Python or

PHP code via a crafted SQL input (bsc#1275460).

* CVE-2026-71491: quadratic complexity in `group_comments` when processing

-only statements can lead to denial of services (bsc#1275466).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server 15 SP6 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3907=1

* Public Cloud Module 15-SP6

zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP6-2026-3907=1

zypper in -t patch SUSE-2026-3907=1

* Python 3 Module 15-SP7

zypper in -t patch SUSE-SLE-Module-Python3-15-SP7-2026-3907=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3907=1

* Public Cloud Module 15-SP6 (noarch)

* python311-sqlparse-0.4.4-150600.3.9.1

* Python 3 Module 15-SP7 (noarch)

* python311-sqlparse-0.4.4-150600.3.9.1

* openSUSE Leap 15.6 (noarch)

* python311-sqlparse-0.4.4-150600.3.9.1

* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)

* python311-sqlparse-0.4.4-150600.3.9.1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)

* python311-sqlparse-0.4.4-150600.3.9.1

*

*

*

*

*

*

*

*

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical DoS Vulnerabilities in python3-sqlparse Affecting SUSE Systems Recent updates for python3-sqlparse have revealed multiple critical denial of service (DoS) vulnerabilities. The vulnerabilities, identified as CVE-2026-54284, CVE-2026-59893, CVE-2026-59894, and CVE-2026-71491, can lead to excessive resource consumption and potential code injection through crafted SQL inputs. Affected systems include various SUSE Linux Enterprise Server versions and openSUSE distributions. The vulnerabilities were published on August 17, 2026, and patches are available for immediate installation. Security professionals are urged to apply these updates to mitigate risks. The vulnerabilities could allow attackers to exploit inefficient parsing and regex handling, leading to service disruptions. Current status indicates that these vulnerabilities are disclosed and patched, with no active exploitation reported yet. 6 sources 59

Extracted Entities

Attack Types (2)

DDoS Sql Injection

CVEs (4)

CVE-2026-54284 CVE-2026-59893 CVE-2026-59894 CVE-2026-71491

CWE Weaknesses (1)

Cwe-89 - SQL Injection

Platforms (3)

Linux OpenSUSE Leap SUSE Linux Enterprise Server