CVE-2026-32588CWE-400

Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing

Medium · published April 7, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
50.6
In the wild
Unconfirmed
What it is

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes.

Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00653 · 50.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-04-07T16:42Z
EPSS history
Timeline
  • 07 APR 16:42Z
    Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing
    cvelistv5