CVE-2026-23985

Awaiting Analysis Awaiting Analysis - Queue

ReDoS Vulnerability in Apache Superset Due to Malformed Regex

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Apache Software Foundation

Description

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Workarounds: ● WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block requests containing excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter. ● Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to reduce the impact of potential attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-23985

EUVD

EUVD-2026-51187

Affected Vendors & Products

Vendor	Product	Version / Range
apache	superset	to 6.0.0 (exc)
apache	superset	6.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This is a Regular Expression Denial of Service (ReDoS) vulnerability in Apache Superset versions 1.5.0 through 5.0.0. It exists in the sql_parse.py component due to a flawed regular expression in the SQL parsing logic. An attacker can exploit it by sending a specially crafted input with long sequences of backslashes or repeated patterns to endpoints processing SQL queries, causing excessive CPU usage and potential service disruption.

Detection Guidance

Monitor for unusually long sequences of backslashes or repeated patterns in SQL query parameters, particularly in the queries.extras.where field. Check Apache Superset logs for slow or failed requests to the /api/v1/chart/data endpoint.

Impact Analysis

An attacker could exploit this to slow down or crash Apache Superset servers by sending malicious input. This may lead to degraded performance, temporary unavailability of the service, or increased server load. The impact is limited to authenticated users as the attacker needs access to send crafted SQL queries.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires maintaining system availability, while HIPAA mandates safeguards against disruptions. Exploitation may lead to unauthorized resource consumption, affecting data processing integrity.

Mitigation Strategies

Upgrade Apache Superset to version 6.0.0 or later. Implement WAF rules to block requests with long backslash sequences or suspicious patterns. Apply rate limiting to the /api/v1/chart/data endpoint.

Hi! I’m here to help you understand CVE-2026-23985. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70