CVE-2026-23985

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description A Regular Expression Denial of Service (ReDoS) occurs in the sql parse.py component due to the SQL REGEX used for parsing SQL statements in the sqlparse library integration. The regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can trigger this by sending a maliciously crafted input string, such as a long sequence of backslashes, to endpoints that process SQL queries, specifically affecting the queries.extras.where parameter and the /api/v1/chart/data endpoint.

Recommendations Upgrade to version 6.0.0. Implement Web Application Firewall (WAF) rules to detect and block requests containing excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter. Apply strict rate limiting to the /api/v1/chart/data endpoint.