PatchTheCVECVE-2026-23985: A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through
40
This month
MEDIUM 6.5WATCHLISTUPGRADE
CVE-2026-23985 is a medium-severity flaw (CVSS 6.5) affecting superset. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciousl
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.7% (top 49%) |
| CISA exploited list | No |
| Weakness | CWE-1333 |
| Published | 2026-07-30 |
| Last modified | 2026-10-23 |
Publisher (CNA): Apache Software Foundation · Vendor: apache
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
apache superset UPGRADE
Affected: >= 1.5.0 and < 6.0.0
Fixed in: 6.0.0
Safe to downgrade to: a release before 1.5.0
1. Check installed version
apt-cache policy superset || rpm -q superset || superset --version
2. UPGRADE to 6.0.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade superset
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade superset
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.5.0 (Debian / Ubuntu)
apt-cache madison superset
sudo apt install superset=<VERSION_BEFORE_1.5.0>
sudo apt-mark hold superset
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list superset
sudo dnf downgrade superset-<VERSION_BEFORE_1.5.0>
sudo dnf versionlock add superset
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-23981 MEDIUM 4.3 UPGRADE An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissi