Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes.
Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/04/07/9 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Apr 2026, 15:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache cassandra
Apache |
|
| CPE | cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:* | |
| References | () https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/04/07/9 - Mailing List, Third Party Advisory |
09 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
07 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-07 17:16
Updated : 2026-04-15 15:45
NVD link : CVE-2026-32588
Mitre link : CVE-2026-32588
CVE.ORG link : CVE-2026-32588
JSON object : View
Products Affected
apache
- cassandra
CWE
CWE-400
Uncontrolled Resource Consumption