CVE-2026-32588

CVE-2026-32588: Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing

Vendor Apache Software Foundation
Product Apache Cassandra
Weakness CWE-400
Published April 7, 2026
Last update April 9, 2026

CVSS base score

What the vulnerability does

Description

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.

Key dates

Disclosure timeline

April 7, 2026 CVE published
April 9, 2026 Record updated