Which versions of Apache Superset are affected by CVE-2026-23985?

Apache Superset (versions 1.5.0-5.0.0) contains a critical regular expression denial-of-service vulnerability in its SQL parser that authenticated users can exploit to crash platform worker…. A patch is available.

How to fix or mitigate CVE-2026-23985?

Within 24 hours, audit Superset user access controls to restrict SQL query submission to essential personnel, and review recent access logs for suspicious query patterns. Within 7 days, implement network-level rate limiting on SQL endpoints, add query execution timeout enforcement (< 5 seconds per query), and establish CPU monitoring alerts on worker processes. Within 30 days, prepare an upgrade to the next Superset release after 5.0.0 when a patch becomes available, or deploy a custom WAF rule to block high-entropy SQL inputs exceeding 10KB or containing nested metacharacters.

Apache Superset CVE-2026-23985

Q: What is the CVSS score of CVE-2026-23985?

CVE-2026-23985 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51187 MEDIUM

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-07-30

GHSA-92hr-7q6h-w7c4

Denial Of Service Apache Superset

5.3

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint, low complexity, but requires an authenticated session (PR:L); impact is availability-only with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 30, 2026 - 17:03 EUVD

CVSS changed

Jul 30, 2026 - 16:37 NVD

5.3 (MEDIUM)

Analysis Generated

Jul 30, 2026 - 12:16 vuln.today

CVE Published

Jul 30, 2026 - 11:18 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Regular Expression Denial of Service in Apache Superset's SQL parser (sql_parse.py) allows authenticated attackers to exhaust CPU resources on Superset worker processes by submitting crafted inputs containing pathological character sequences to SQL-processing endpoints. Versions 1.5.0 through 5.0.0 are affected via a vulnerable SQL_REGEX pattern that exhibits catastrophic backtracking under adversarial input. No public exploit code or active exploitation has been identified at time of analysis; the authentication prerequisite meaningfully limits opportunistic attack surface.

Technical ContextAI

The vulnerability resides in the sql_parse.py module within Apache Superset's integration with the sqlparse library. The SQL_REGEX regular expression pattern contains overlapping disjunctions that share a common outer quantifier - the canonical structure that produces catastrophic backtracking in backtracking-based NFA regex engines. When the engine encounters a pathological input (specifically long sequences of backslashes or similar repeated characters), backtracking complexity degrades to polynomial or exponential time, consuming a worker thread's CPU for the entire duration of the request. This is a textbook instance of CWE-1333 (Inefficient Regular Expression Complexity). No CPE strings were provided in the source data, but affected scope is clearly Apache Superset 1.5.0 through 5.0.0, with the fix committed in 6.0.0.

RemediationAI

The primary remediation is to upgrade Apache Superset to version 6.0.0 or later, which resolves the vulnerable SQL_REGEX pattern in sql_parse.py; this is the only complete fix. If immediate upgrade is not feasible, two vendor-documented compensating controls are available: first, deploy WAF rules targeting the queries.extras.where parameter to detect and block requests containing excessively long sequences of backslashes or anomalous repeated patterns - note that aggressive WAF rules carry a false-positive risk against legitimate complex SQL queries and require tuning; second, apply strict rate limiting to the /api/v1/chart/data endpoint to reduce the throughput achievable by an attacker and cap the availability impact, though this does not prevent individual slow requests from tying up worker threads. Both workarounds are temporary mitigations that do not eliminate the underlying vulnerability. Advisory references: https://superset.apache.org and https://www.cve.org/CVERecord?id=CVE-2026-23985.