6.5Media
CVE-2026-32588Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing
Descripción
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.
Debilidad (CWE):
CWE-400
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Apache Software Foundation | Apache Cassandra | 4.0 – ≤ 4.0.19, 4.1 – ≤ 4.1.10, 5.0 – ≤ 5.0.6 | |
| apache | cassandra | 4.0.0 – < 4.0.20 |
Referencias y parches
- https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/07/9 Mailing ListThird Party Advisory
Coincidencias CPE (NVD) (3)
cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.20cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.11cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.7