Executive brief
Apache Superset, a data visualization and exploration platform, is vulnerable to a denial-of-service attack. An authorized user can send a specially crafted database query containing long sequences of characters that causes the system's SQL parser to consume excessive CPU resources. This can lead to significant performance degradation or a complete service outage for all users.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability (CWE-1333) exists in the `sql_parse.py` component of Apache Superset. The `SQL_REGEX` used for parsing SQL statements contains overlapping disjunctions with a common outer quantifier, leading to exponential backtracking when processing certain patterns. An authenticated attacker can trigger this by submitting a query with a long sequence of backslashes or repeated patterns to endpoints like `/api/v1/chart/data`. The issue is fixed in version 6.0.0; workarounds include implementing WAF rules to block long backslash sequences in the `queries.extras.where` parameter and applying strict rate limiting.
Affected products
- Apache Superset 1.5.0 through 5.0.0; all versions before 6.0.0
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory