{
  "from_raw": "Daniel Gaspar <dpgaspar@apache.org>",
  "from": "Daniel Gaspar <dp...@apache.org>",
  "gravatar": "90a0c7a7509c2d1826e37fc5cf535da8",
  "to": "an...@apache.org,\n us...@superset.apache.org",
  "subject": "CVE-2026-23985: Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser",
  "message-id": "<531f6a1b-663b-8f8c-e45c-390d593059a2@apache.org>",
  "mid": "cpklslk3dby5dyw59f54ft5tf5t8pr3m",
  "permalinks": [
    "cpklslk3dby5dyw59f54ft5tf5t8pr3m",
    "re582b0e2f654d5e1a5615e2f2352c1cef36c331d03f99a7acf74fd66@<announce.apache.org>"
  ],
  "dbid": "89f0757965e0b45906bff5dc02b74e9314f813bfe393c01f7de6a07f888c71ad",
  "cc": "us...@superset.apache.org",
  "epoch": 1785403313,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/07/30 09:21:53",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: \n\nAffected versions:\n\n- Apache Superset before 6.0.0\n\nDescription:\n\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration.\nThe affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries\n\nThis issue affects Apache Superset: before 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.0, which fixes the issue.\u00a0\n\nWorkarounds:\n\u25cf WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block\nrequests containing excessively long sequences of backslashes or suspicious repeated\npatterns in the queries.extras.where parameter.\n\u25cf Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to\nreduce the impact of potential attacks.\n\nCredit:\n\nTrung \u0110\u1ee9c L\u00ea (reporter)\nBeto de Almeida (remediation developer)\n\nReferences:\n\nhttps://superset.apache.org\nhttps://www.cve.org/CVERecord?id=CVE-2026-23985\n\n",
  "body_short": "Severity: \n\nAffected versions:\n\n- Apache Superset before 6.0.0\n\nDescription:\n\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vu",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 3994,
  "id": "cpklslk3dby5dyw59f54ft5tf5t8pr3m"
}