CVE-2023-42504: Apache Superset Allocation of Resources Without Limits or Throttling Vulnerability
Summary
CVE-2023-42504: Apache Superset Allocation of Resources Without Limits or Throttling vulnerability. Affects apache-superset versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2023-42504 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating interactive dashboards, charts, and reports. This vulnerability affects versions of Apache Superset prior to 3.0.0. The vulnerability allows an authenticated malicious user to initiate multiple concurrent requests, each requesting multiple dashboard exports. This can lead to a possible denial of service.
Vulnerability Detail
The vulnerability in Apache Superset allows an authenticated malicious user to exploit the lack of limits or throttling on resource allocation. By initiating multiple concurrent requests for dashboard exports, the system can become overwhelmed and unresponsive, resulting in a denial of service. This vulnerability has a CVSS score of 5.8, indicating a moderate severity level.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
pip install --upgrade "apache-superset==3.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Apache Superset to address the issue effectively.
Conclusion
The Apache Superset Allocation of Resources Without Limits or Throttling vulnerability allows an authenticated malicious user to initiate multiple concurrent requests, potentially leading to a denial of service. It is crucial to upgrade to Apache Superset version 3.0.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards, charts, and reports.
The vulnerability allows an authenticated malicious user to initiate multiple concurrent requests, leading to a possible denial of service. This can result in system unresponsiveness and disruption of service.
To fix this vulnerability, it is recommended to upgrade to Apache Superset version 3.0.0 or later. This version includes the necessary fixes and mitigations to prevent the resource allocation issue.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Apache Superset to address the issue effectively.
This vulnerability has a CVSS score of 5.8, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
