CVE-2026-23985— Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Superset | < 6.0.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-23985
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser
Source: CVE Program / CVE List V5
Vulnerability Description
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Workarounds: ● WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block requests containing excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter. ● Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to reduce the impact of potential attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Superset 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache superset是美国Apache基金会开源的一款数据可视化平台。 Apache Superset 6.0.0之前版本存在资源管理错误漏洞，该漏洞源于sql_parse.py组件中的SQL_REGEX正则表达式处理不当，包含重叠析取且共享公共外部量词，可能导致经过身份验证的攻击者通过发送特制的长反斜杠序列输入字符串，造成正则表达式拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Superset | 0 ~ 6.0.0 | - |
II. Public POCs for CVE-2026-23985
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23985
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-23985 (1)
Same Patch Batch · Apache Software Foundation · 2026-07-30 · 13 CVEs total
| CVE-2026-66756 | 6.9 MEDIUM | Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=fal |
| CVE-2026-66755 | 5.9 MEDIUM | Apache Tika: Arbitrary Local File Read in ISArchiveParser |
| CVE-2026-23981 | 5.3 MEDIUM | Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification |
| CVE-2026-44613 | Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling | |
| CVE-2026-44616 | Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction | |
| CVE-2026-44617 | Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 | |
| CVE-2026-28811 | Apache JSPWiki: Error Handling - Reveals Error Details | |
| CVE-2026-28812 | Apache JSPWiki: UserManager does not sanity-check user database at startup | |
| CVE-2026-28813 | Apache JSPWiki: JSPWiki vulnerable to JSON hijacking | |
| CVE-2026-28814 | Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering | |
| CVE-2026-48910 | Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing | |
| CVE-2026-52680 | Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write |
IV. Related Vulnerabilities
Same product: Apache Superset
- CVE-2026-23981
Apache Superset: Improper Authorization in Chart Update allo - CVE-2026-23969
Apache Superset: Exposure of Sensitive Information via Incom - CVE-2026-23980
Apache Superset: Improper Neutralization of Special Elements - CVE-2026-23982
Apache Superset: Improper Authorization in Dataset Creation - CVE-2026-23983
Apache Superset: Sensitive Data Exposure via REST API (disab
Same vendor: Apache Software Foundation
- CVE-2026-44615
Path traversal in NotebookRepo note and folder path composit - CVE-2026-64607
Apache HttpComponents Client: Connection Leak on Content-Enc - CVE-2026-62391
Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass vi - CVE-2026-66756
Apache Tika: unpack endpoint in tika-server allows configura - CVE-2026-66755
Apache Tika: Arbitrary Local File Read in ISArchiveParser
Same weakness: CWE-1333
- CVE-2026-60075
Date::Manip versions through 6.99 for Perl allow CPU exhaust - CVE-2026-16270
ReDoS in Open Mercato - CVE-2026-49485
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in - CVE-2026-52746
JSONata: Malicious inputs to "$toMillis" function can cause - CVE-2026-14741
HTTP::Date versions before 6.08 for Perl allow CPU exhaustio
V. Comments for CVE-2026-23985
No comments yet