CVE-2026-23985 in Superset
Summary
by MITRE • 07/30/2026
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries
This issue affects Apache Superset: before 6.0.0.
Users are recommended to upgrade to version 6.0.0, which fixes the issue.
Workarounds: ● WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block requests containing excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter. ● Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to reduce the impact of potential attacks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability described represents a classic Regular Expression Denial of Service (ReDoS) flaw that has significant implications for Apache Superset's security posture. This issue manifests within the sql_parse.py component where the SQL_REGEX pattern is utilized for parsing SQL statements through integration with the sqlparse library. The technical root cause stems from overlapping disjunctions within the regular expression that share a common outer quantifier, creating a catastrophic backtracking scenario when processing malicious input patterns.
The operational impact of this vulnerability extends beyond simple performance degradation to potential system compromise. An authenticated attacker can exploit this weakness by crafting specially formatted input strings containing extended sequences of backslashes or similar repetitive character patterns. These inputs are particularly dangerous when submitted to endpoints responsible for processing SQL queries, specifically targeting the sqlparse library integration within Apache Superset's codebase. The vulnerability affects all versions from 1.5.0 through 5.0.0, making it a widespread concern for organizations utilizing these releases.
The technical exploitation mechanism follows established ReDoS patterns where malicious input triggers exponential execution time growth in the regular expression engine. When the sqlparse library processes these crafted inputs, the overlapping disjunctions cause the regex engine to perform excessive backtracking operations, consuming system resources and potentially leading to service unavailability. This vulnerability classification aligns with CWE-400 which specifically addresses Uncontrolled Resource Consumption and maps to ATT&CK technique T1496 for Resource Hijacking through denial of service attacks.
Organizations should prioritize upgrading to Apache Superset version 6.0.0 or later to address this vulnerability completely, as the fix involves proper regex pattern optimization that eliminates the overlapping disjunctions causing the catastrophic backtracking behavior. While waiting for the upgrade, security teams can implement defensive measures including WAF rules designed to detect and block requests containing suspicious patterns in the queries.extras.where parameter, particularly those with excessively long sequences of backslashes. Additionally, implementing strict rate limiting on the /api/v1/chart/data endpoint provides crucial protection against potential exploitation attempts by limiting the frequency of potentially malicious requests that could trigger the ReDoS condition.
The vulnerability demonstrates how seemingly innocuous input processing components can become attack vectors when regular expression patterns are not carefully constructed to avoid catastrophic backtracking scenarios. This highlights the importance of security reviews for all regex implementations, particularly those handling user-supplied data in web applications. The remediation approach emphasizes both immediate defensive measures and long-term architectural improvements to prevent similar vulnerabilities from emerging in future code releases.
This ReDoS vulnerability exemplifies how authentication requirements do not necessarily protect against resource exhaustion attacks, as the attack can be executed by authenticated users who have legitimate access to query processing endpoints. The security implications extend beyond simple service disruption to potential denial of service against authorized users, making this a critical vulnerability requiring immediate attention from system administrators and security teams responsible for maintaining Apache Superset installations.