Description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration.
The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the issue. 

Workarounds:
● WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block
requests containing excessively long sequences of backslashes or suspicious repeated
patterns in the queries.extras.where parameter.
● Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to
reduce the impact of potential attacks.
Published: 2026-07-30
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A Regular Expression Denial of Service flaw exists in the SQL parsing component of Apache Superset, allowing an authenticated attacker to trigger catastrophic backtracking by sending a long string of backslashes or similar characters. This leads to excessive CPU consumption and application unresponsiveness, governed by CWE‑1333. The vulnerability is confined to input validation performed by the sqlparse library.

Affected Systems

Apache Superset versions 1.5.0 through 5.0.0, and all releases prior to 6.0.0, are affected. The flaw is present in the sql_parse.py module of the application.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV. An attacker must first authenticate to the Superset instance and then target endpoints that process SQL queries to exploit the flaw. The attack would likely result in denial of service through long‑running regex processing, but does not directly lead to code execution or data exfiltration.

Generated by OpenCVE AI on August 3, 2026 at 10:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official upgrade to Apache Superset 6.0.0, which removes the vulnerable regular expression.
  • Deploy Web Application Firewall rules that detect and block requests containing excessively long backslash sequences or suspicious repeated patterns in the queries.extras.where parameter.
  • Configure strict rate limiting on the /api/v1/chart/data endpoint to reduce the impact of repeated malicious requests.

Generated by OpenCVE AI on August 3, 2026 at 10:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 30 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache superset
Vendors & Products Apache
Apache superset

Thu, 30 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.  Workarounds: ● WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block requests containing excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter. ● Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to reduce the impact of potential attacks.
Title Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser
Weaknesses CWE-1333
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Apache Superset
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-30T19:16:46.521Z

Reserved: 2026-01-19T17:23:00.841Z

Link: CVE-2026-23985

cve-icon Vulnrichment

Updated: 2026-07-30T16:36:25.754Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T16:17:10.577

Modified: 2026-08-05T19:38:49.087

Link: CVE-2026-23985

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T10:45:03Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity