Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing (Apache Software Foundation Apache Cassandra)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.53 % · percentile 45 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Analyzed
Description
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.
Weaknesses (CWE)
- CWE-400 — Uncontrolled Resource Consumption
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | CISA-ADP |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Advisories
- GHSA-qffm-gf3j-6mvg — Apache Cassandra has an authenticated DoS over CQL
European references
- ENISA EUVD · EUVD-2026-19769
- GCVE · GCVE-0-2026-32588
Affected configurations (NVD CPE)
cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.20cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.11cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.7
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Cassandra | affected 4.0 ≤ 4.0.19 ; affected 4.1 ≤ 4.1.10 ; affected 5.0 ≤ 5.0.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |