CVE-2026-23985 Details
Description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Workarounds: ● WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block requests containing excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter. ● Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to reduce the impact of potential attacks.
A Regular Expression Denial-of-Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 prior to 5.0.0. The issue is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The vulnerable regular expression contains overlapping disjunctions that share a common outer quantifier, allowing an authenticated attacker to exploit this by sending a maliciously crafted input string, such as a long sequence of backslashes or similar characters, to endpoints that process SQL queries.
Users are advised to upgrade to Apache Superset version 6.0.0 or later, which addresses this vulnerability. Additionally, Web Application Firewall (WAF) rules can be implemented to detect and block requests with excessively long sequences of backslashes or suspicious repeated patterns in the queries. Strict rate limiting should also be applied to the /api/v1/chart/data endpoint to mitigate potential attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/30/7 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/fdy7tx7glv90ypd7qnm1g1pt7nn336qx | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache superset | >= 1.5.0, < 6.0.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | CVE Modified | CVE |
| Jul 30, 2026 | New CVE Received | [email protected] |