GHSA-qffm-gf3j-6mvg

Apache Cassandra has an authenticated DoS over CQL

En bref

Publiée: 2026-04-07 18:31 UTC
Mise à jour: 2026-04-08 20:11 UTC
CVE: CVE-2026-32588
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Description

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.

Paquets affectés

Paquet	Versions
Maven · org.apache.cassandra:cassandra-all	introduced 4.0, fixed 4.0.20
Maven · org.apache.cassandra:cassandra-all	introduced 4.1, fixed 4.1.11
Maven · org.apache.cassandra:cassandra-all	introduced 5.0, fixed 5.0.7

Références

https://nvd.nist.gov/vuln/detail/CVE-2026-32588 ADVISORY
https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc WEB
http://www.openwall.com/lists/oss-security/2026/04/07/9 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database