GitHub Advisoryadvisory · Maven

GHSA-qffm-gf3j-6mvg Apache Cassandra has an authenticated DoS over CQL

LOW Published 2026-04-07 Modified 2026-04-08 Official page ↗
Aliases
CVE-2026-32588
Ecosystem
Maven
Packages
org.apache.cassandra:cassandra-all
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-400
Reviewed
2026-04-08

Affected packages

• Maven org.apache.cassandra:cassandra-all: >= 4.0, < 4.0.20 → fixed in 4.0.20 • Maven org.apache.cassandra:cassandra-all: >= 4.1, < 4.1.11 → fixed in 4.1.11 • Maven org.apache.cassandra:cassandra-all: >= 5.0, < 5.0.7 → fixed in 5.0.7

Description

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-32588 Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References