AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-3hp7-4qq4-v5c6

Apache Superset Allocation of Resources Without Limits or Throttling vulnerability

Apache Superset

CVE-2023-42504 · Published Nov 28, 2023 · updated Jul 7, 2026

Medium6.5
Fix: upgrade to 3.0.0 or later
GitHub advisory

An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service.

This issue affects Apache Superset: before 3.0.0

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 3.0.03.0.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-770
Also known as
BIT-superset-2023-42504, CVE-2023-42504, PYSEC-2026-1157

More Apache Superset advisories

All Apache Superset
Medium 6.5Dec 19, 2023Apache Superset SQL injection vulnerabilityCVE-2023-49736fixed in 2.1.3 +1High 7.3Nov 28, 2023Apache Superset - Elevation of PrivilegeCVE-2023-40610fixed in 2.1.2Medium 4.3Nov 28, 2023Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCVE-2023-42505fixed in 3.0.0Medium 5.4Nov 28, 2023Apache Superset Open Redirect vulnerabilityCVE-2023-42502fixed in 3.0.0Medium 4.3Nov 27, 2023Apache Superset has Incorrect Default PermissionsCVE-2023-42501fixed in 2.1.2Medium 4.3Nov 27, 2023Apache Superset Cross-site Scripting vulnerabilityCVE-2023-43701fixed in 2.1.2