CVE-2026-54284
HighAdvisory
Published 17 Aug 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.003
- 18th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 153
- of 17,781 indexed, latest versions
- Container images
- 149
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
Carried by container images the latest versions of 153 of 17,781 indexed charts deploy, on 149 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| sqlparsepypi | 0.1.16, 0.2.2, 0.2.4, 0.3.0+10 more | 0.6.0 | 149 |
| sqlparsedeb | 0.2.4-3 | no fix listed | 1 |
- OSV records
- GHSA-pwgv-4x5q-6m9fUBUNTU-CVE-2026-54284
- Also known as
- PYSEC-2026-3699
Charts affected
153 by stars
Container images carrying it
149 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| dpage/ | 2f4ce946ddf8 | sqlparse | 0.6.0 | 5 |
| cloudve/ | 4a3d7fae90bb | sqlparse | 0.6.0 | 3 |
| dpage/ | 781369df9994 | sqlparse | 0.6.0 | 3 |
| amancevice/ | 12a0a9e66550 | sqlparse | 0.6.0 | 2 |
| larribas/ | 05ccb0b46bfb | sqlparse | 0.6.0 | 2 |
| safeglobal/ | 09a5e495c219 | sqlparse | 0.6.0 | 2 |
| safeglobal/ | 80db836cc5d5 | sqlparse | 0.6.0 | 2 |
| taigaio/ | 4beed8f62c9f | sqlparse | 0.6.0 | 2 |
| weblate/ | 69c160d37a3c | sqlparse | 0.6.0 | 2 |
| ghcr.io/ | 612d76760b54 | sqlparse | 0.6.0 | 2 |
| ghcr.io/ | a1bc133af84e | sqlparse | 0.6.0 | 2 |
| alexeyr7/ | df0b41fdbd53 | sqlparse | 0.6.0 | 1 |
| amancevice/ | c8c04bfe3d66 | sqlparse | 0.6.0 | 1 |
| apache/ | 64e58748b6b9 | sqlparse | 0.6.0 | 1 |
| apache/ | ce90bdc3d2af | sqlparse | 0.6.0 | 1 |
| apache/ | e5560ad0b86e | sqlparse | 0.6.0 | 1 |
| apache/ | 975ab033580d | sqlparse | 0.6.0 | 1 |
| apache/ | ab9467fd712c | sqlparse | 0.6.0 | 1 |
| apecloud/ | 8ac9947a2c84 | sqlparse | 0.6.0 | 1 |
| archivebox/ | 1a5a37331091 | sqlparse | 0.6.0 | 1 |
| baserow/ | 7c00549b3a6f | sqlparse | 0.6.0 | 1 |
| baserow/ | e0b3c8130b91 | sqlparse | 0.6.0 | 1 |
| baserow/ | df0c42eb67e8 | sqlparse | 0.6.0 | 1 |
| blackducksoftware/ | b10eaea94fd3 | sqlparse | 0.6.0 | 1 |
| buntha/ | 154542cc3083 | sqlparse | 0.6.0 | 1 |
| camerahub/ | a5af37dd6e1b | sqlparse | 0.6.0 | 1 |
| chiefonboarding/ | 59bc7aa60fe7 | sqlparse | 0.6.0 | 1 |
| chorss/ | 5c549cacb8ab | sqlparse | 0.6.0 | 1 |
| codecov/ | 0475cb1c3136 | sqlparse | 0.6.0 | 1 |
| codecov/ | 837f546b479b | sqlparse | 0.6.0 | 1 |
| cr0hn/ | 14482d0bc4a1 | sqlparse | 0.6.0 | 1 |
| datagrok/ | 8c2d48c1545c | sqlparse | 0.6.0 | 1 |
| datamate/ | 2dd66b722464 | sqlparse | 0.6.0 | 1 |
| ddosify/ | a43c5155fa1c | sqlparse | 0.6.0 | 1 |
| ddosify/ | e5be48b37348 | sqlparse | 0.6.0 | 1 |
| ddosify/ | 3c11e3182652 | sqlparse | 0.6.0 | 1 |
| ddosify/ | ac323d52bfb4 | sqlparse | 0.6.0 | 1 |
| ddosify/ | 71b8768f49bc | sqlparse | 0.6.0 | 1 |
| ddosify/ | b796b8c73011 | sqlparse | 0.6.0 | 1 |
| dpage/ | 18cd5711fc9a | sqlparse | 0.6.0 | 1 |
| dpage/ | 37946e4f3e7b | sqlparse | 0.6.0 | 1 |
| dpage/ | 50700ac17936 | sqlparse | 0.6.0 | 1 |
| dpage/ | 52cb72a9e3da | sqlparse | 0.6.0 | 1 |
| dpage/ | 561c1f8f99f2 | sqlparse | 0.6.0 | 1 |
| dpage/ | a5a656e1d5fd | sqlparse | 0.6.0 | 1 |
| dpage/ | b1f00b8163cf | sqlparse | 0.6.0 | 1 |
| evk02/ | ef6ff257ef35 | sqlparse | 0.6.0 | 1 |
| fiware/ | 29456835bb2c | sqlparse | 0.6.0 | 1 |
| flagsmith/ | fd58556339a4 | sqlparse | 0.6.0 | 1 |
| galaxy/ | e5c265fe9fcd | sqlparse | 0.6.0 | 1 |