Denial of Service Vulnerability in Apache Cassandra
CVE-2026-32588

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Cassandra
Vendor
CVE Published:
7 April 2026

What is CVE-2026-32588?

An authenticated denial of service vulnerability exists in Apache Cassandra, affecting the 4.0, 4.1, and 5.0 versions. This vulnerability allows users with authenticated access to increase query latencies by repeatedly changing their passwords. This can lead to significant performance degradation and potential service outages. It is recommended that users upgrade to versions 4.0.20, 4.1.11, or 5.0.7 to mitigate the impact of this vulnerability.

Affected Version(s)

Apache Cassandra 4.0 <= 4.0.19

Apache Cassandra 4.1 <= 4.1.10

Apache Cassandra 5.0 <= 5.0.6

References

https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k5...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Youlong Chen, Institute of Computing Technology, Chinese Academy of Sciences
.