Description
Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.
Affected products
apache: cassandra
References2
- lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc Mailing ListVendor Advisory
- www.openwall.com/lists/oss-security/2026/04/07/9 Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 1% percentile: 47 · as of 12 November 2026
- CWE
- CWE-400
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.