{"id":"GHSA-qffm-gf3j-6mvg","summary":"Apache Cassandra has an authenticated DoS over CQL","details":"Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes.\nUsers are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.","aliases":["CVE-2026-32588"],"modified":"2026-04-08T20:11:28.479622Z","published":"2026-04-07T18:31:37Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-04-08T19:31:59Z","nvd_published_at":"2026-04-07T17:16:28Z","cwe_ids":["CWE-400"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32588"},{"type":"WEB","url":"https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/04/07/9"}],"affected":[{"package":{"name":"org.apache.cassandra:cassandra-all","ecosystem":"Maven","purl":"pkg:maven/org.apache.cassandra/cassandra-all"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0"},{"fixed":"4.0.20"}]}],"versions":["4.0.0","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.15","4.0.16","4.0.17","4.0.18","4.0.19","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qffm-gf3j-6mvg/GHSA-qffm-gf3j-6mvg.json"}},{"package":{"name":"org.apache.cassandra:cassandra-all","ecosystem":"Maven","purl":"pkg:maven/org.apache.cassandra/cassandra-all"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1"},{"fixed":"4.1.11"}]}],"versions":["4.1.0","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qffm-gf3j-6mvg/GHSA-qffm-gf3j-6mvg.json"}},{"package":{"name":"org.apache.cassandra:cassandra-all","ecosystem":"Maven","purl":"pkg:maven/org.apache.cassandra/cassandra-all"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.7"}]}],"versions":["5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qffm-gf3j-6mvg/GHSA-qffm-gf3j-6mvg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}