CVE-2026-71491
HighAdvisory
Published 17 Aug 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.003
- 18th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 153
- of 17,781 indexed, latest versions
- Container images
- 149
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
sqlparse: Quadratic O(n²) DoS in group_comments
Carried by container images the latest versions of 153 of 17,781 indexed charts deploy, on 149 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| sqlparsepypi | 0.1.16, 0.2.2, 0.2.4, 0.3.0+10 more | 0.6.0 | 149 |
| sqlparsedeb | 0.2.4-3 | no fix listed | 1 |
- OSV records
- GHSA-f2ff-p2ww-7p4pUBUNTU-CVE-2026-71491
- Also known as
- PYSEC-2026-3697
Charts affected
153 by stars
Container images carrying it
149 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| galaxy/ | 0267bad550e6 | sqlparse | 0.6.0 | 1 |
| gethue/ | 11b649636e68 | sqlparse | 0.6.0 | 1 |
| gethue/ | 5702b2c37ff9 | sqlparse | 0.6.0 | 1 |
| gethue/ | 7d5c1b9f8a79 | sqlparse | 0.6.0 | 1 |
| gluufederation/ | 1a1128b28b95 | sqlparse | 0.6.0 | 1 |
| grafana/ | 499851658393 | sqlparse | 0.6.0 | 1 |
| graphiteapp/ | 04a0037cc2ae | sqlparse | 0.6.0 | 1 |
| ha33ona/ | 6affdfc644d0 | sqlparse | 0.6.0 | 1 |
| healthchecks/ | e82bb0836e30 | sqlparse | 0.6.0 | 1 |
| heartexlabs/ | aa461572e8f9 | sqlparse | 0.6.0 | 1 |
| hhyo/ | 1aa41843419e | sqlparse | 0.6.0 | 1 |
| homeassistant/ | 5a531753cea9 | sqlparse | 0.6.0 | 1 |
| improwised/ | 97280b55cbd4 | sqlparse | 0.6.0 | 1 |
| intelowlproject/ | 0b22e547ea6b | sqlparse | 0.6.0 | 1 |
| kelvinsp/ | cd33e6db2a59 | sqlparse | 0.6.0 | 1 |
| kobotoolbox/ | b15679454415 | sqlparse | 0.6.0 | 1 |
| kobotoolbox/ | bcacc01bccd4 | sqlparse | 0.6.0 | 1 |
| kporwit/ | 217de0302218 | sqlparse | 0.6.0 | 1 |
| langgenius/ | dcefa5f7c47c | sqlparse | 0.6.0 | 1 |
| langgenius/ | fca918260dd6 | sqlparse | 0.6.0 | 1 |
| linuxserver/ | f7d7c7704249 | sqlparse | 0.6.0 | 1 |
| linuxserver/ | 50792a72fc71 | sqlparse | 0.6.0 | 1 |
| linuxserver/ | 94696dab3c50 | sqlparse | 0.6.0 | 1 |
| maponyacharles/ | 42d418654ebd | sqlparse | 0.6.0 | 1 |
| maponyacharles/ | 7b37b092130a | sqlparse | 0.6.0 | 1 |
| mathesar/ | 091757cb01fe | sqlparse | 0.6.0 | 1 |
| milesmcc/ | ba54f7797a6b | sqlparse | 0.6.0 | 1 |
| milesmcc/ | e821e31140f7 | sqlparse | 0.6.0 | 1 |
| mondata/ | 6f94c6caf8bf | sqlparse | 0.6.0 | 1 |
| netboxcommunity/ | 3d652dca5351 | sqlparse | 0.6.0 | 1 |
| netboxcommunity/ | 9bf83b350a89 | sqlparse | 0.6.0 | 1 |
| networktocode/ | ed484336b1ad | sqlparse | 0.6.0 | 1 |
| opencsghq/ | c36a5bac3cf0 | sqlparse | 0.6.0 | 1 |
| opencsghq/ | 47e22aa71870 | sqlparse | 0.6.0 | 1 |
| opencsghq/ | b4e849fcf94a | sqlparse | 0.6.0 | 1 |
| opennode/ | 4c82b15d9042 | sqlparse | 0.6.0 | 1 |
| openstackhelm/ | f728510bab3c | sqlparse | 0.6.0 | 1 |
| openstackhelm/ | e07d75953d2e | sqlparse | 0.6.0 | 1 |
| openzaak/ | 2e65313b9b10 | sqlparse | 0.6.0 | 1 |
| openzaak/ | 2ca2ea6e0ae9 | sqlparse | 0.6.0 | 1 |
| pretix/ | 5df3b7aa852e | sqlparse | 0.6.0 | 1 |
| prowlercloud/ | 4f252d579be2 | sqlparse | 0.6.0 | 1 |
| psono/ | 3b974b43ea03 | sqlparse | 0.6.0 | 1 |
| recordsansible/ | 9dfd6e18f474 | sqlparse | 0.6.0 | 1 |
| redash/ | 00d813437db5 | sqlparse | 0.6.0 | 1 |
| redash/ | 9392753c0376 | sqlparse | 0.6.0 | 1 |
| redash/ | c5c9148f5c38 | sqlparse | 0.6.0 | 1 |
| redislabs/ | b03ab1426d0d | sqlparse | 0.6.0 | 1 |
| seafileltd/ | 6693911bcc40 | sqlparse | 0.6.0 | 1 |
| seafileltd/ | 70628f29c663 | sqlparse | 0.6.0 | 1 |