CVE-2023-46104 Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb

Medium 6.5 Published 19 Dec 2023 Updated 13 Feb 2025

An authenticated attacker can cause denial of service by uploading a malicious ZIP bomb to import resources in Apache Superset.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-46104?

CVE-2023-46104 is a medium-severity denial of service vulnerability in Apache Superset, published on 19 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.

Weakness: CWE-400

Which versions are affected by CVE-2023-46104?

6 open source packages ship an affected version, including apache-superset and superset. It affects 1 product.

Package	Affected	Fixed in
`apache-superset` PyPI	All versions	`2.1.2, 3.1.0rc1`
`apache-superset` PyPI	All versions	`2.1.2`
`apache-superset` PyPI	All versions	`2.1.2`
`apache-superset` PyPI	From `3.0.0`	`3.1.0rc1`
`apache-superset` PyPI	From `3.0.0`	`3.1.0rc1`
`superset` Bitnami	All versions	`2.1.3, 3.0.1`

Products include Apache Superset.

How do I fix CVE-2023-46104?

Upgrade apache-superset to a fixed version for your release line: 2.1.2 or 3.1.0rc1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-46104 being exploited?

There is no known exploitation of CVE-2023-46104 in the wild and no public exploit code.

All Apache Superset vulnerabilities

Sources

Also known as BIT-superset-2023-46104, GHSA-95mg-jgfx-54v9, PYSEC-2026-1167.