This vulnerability in Apache Superset (CVE-2026-23985) involves a Regular Expression Denial of Service (ReDoS) caused by inefficient regular expression complexity in the sql_parse.py component's SQL_REGEX. The regex contains overlapping disjunctions with a common outer quantifier, which can be exploited by an authenticated attacker sending crafted input strings containing long sequences of backslashes or similar characters to endpoints that process SQL queries, such as /api/v1/chart/data. This causes excessive processing time, leading to denial of service. The issue affects all versions before 6.0.0. The vendor recommends upgrading to version 6.0.0, which fixes the vulnerability. Additional mitigations include WAF rules to detect and block suspicious patterns and rate limiting to reduce attack impact.

An authenticated attacker can cause a denial of service condition by exploiting the inefficient regular expression in SQL parsing, leading to excessive CPU consumption and potential service disruption. The impact is limited to denial of service and requires authentication, with no indication of data breach or privilege escalation.

Users should upgrade to Apache Superset version 6.0.0, which contains the fix for this vulnerability. Until upgrading, implement Web Application Firewall (WAF) rules to detect and block requests with excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter. Additionally, apply strict rate limiting on the /api/v1/chart/data endpoint to reduce the potential impact of attacks. Patch status is not explicitly confirmed in the vendor advisory, but the upgrade to version 6.0.0 is recommended as the fix.