Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb
Priority LOW 32CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01667 76th percentileScored 2026-11-07
Fix Fixed Apache Superset (Apache Software Foundation): 2.1.3, 3.0.1apache-superset (PyPI): 2.1.2, 3.1.0rc1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Superset | before 2.1.3; 3.0.0 to before 3.0.1 | 2.1.3, 3.0.1 | Patch available | CNA |
| — | apache-superset (PyPI) | before 2.1.2 | 2.1.2 | Patch available | GHSA-95mg-jgfx-54v9 |
| — | apache-superset (PyPI) | 3.0.0 to before 3.1.0rc1 | 3.1.0rc1 | Patch available | GHSA-95mg-jgfx-54v9 |
- Apache Superset VendorApache Affected before 2.1.3; 3.0.0 to before 3.0.1 Fixed in 2.1.3, 3.0.1 Patch available CNA
- apache-superset (PyPI) Vendor— Affected before 2.1.2 Fixed in 2.1.2 Patch available GHSA-95mg-jgfx-54v9
- apache-superset (PyPI) Vendor— Affected 3.0.0 to before 3.1.0rc1 Fixed in 3.1.0rc1 Patch available GHSA-95mg-jgfx-54v9
Remediation
- Fix · CNA Apache Superset (Apache Software Foundation) Fixed in 2.1.3, 3.0.1
- Fix · GHSA-95mg-jgfx-54v9 apache-superset (PyPI) Fixed in 2.1.2 Advisory →
- Fix · GHSA-95mg-jgfx-54v9 apache-superset (PyPI) Fixed in 3.1.0rc1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-46104
- 2026-10-03 Alias added: GHSA-95mg-jgfx-54v9
References
Advisory 2
Other 6
- http://www.openwall.com/lists/oss-security/2023/12/19/1
- http://www.openwall.com/lists/oss-security/2024/02/14/2
- http://www.openwall.com/lists/oss-security/2024/02/14/3
- https://github.com/apache/superset/commit/7c23cb0b3fd224c320b35f05e74b572033569154
- https://github.com/apache/superset/commit/f473d13d0d89de5990209ff81b17dfe2cee884d3
- https://github.com/apache/superset
More Apache Superset vulnerabilities
- TI-2023-12249 Apache Superset: Session validation vulnerability when using provided default SECRET_KEY KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05798 Deserialization of untrusted data in Superset CVSS 3.0CRITICAL 9.8
- TI-2023-21408 Apache Superset: Privilege escalation with default examples database CVSS 3.1HIGH 8.8
- TI-2023-20410 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections CVSS 3.1MEDIUM 6.5
- TI-2021-09242 Apache Superset stored XSS on Dashboard markdown CVSS 3.1MEDIUM 5.4
- TI-2021-09359 Apache Superset Open Redirect CVSS 3.1MEDIUM 6.1
Sources
- CVE-2023-46104 · CVE Program
- CVE-2023-46104 · NVD
- FIRST EPSS
- GHSA-95mg-jgfx-54v9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences