CVE-2026-32588

{
  "id": "CVE-2026-32588",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T17:16:28.297",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes.\nUsers are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue."
    },
    {
      "lang": "es",
      "value": "DoS autenticado sobre CQL en Apache Cassandra 4.0, 4.1, 5.0 permite a un usuario autenticado aumentar las latencias de las consultas mediante cambios repetidos de contraseña. Se recomienda a los usuarios actualizar a la versión 4.0.20, 4.1.11, 5.0.7, que corrige este problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Cassandra",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2/",
          "packageName": "org.apache.cassandra:cassandra-all",
          "versions": [
            {
              "version": "4.0",
              "lessThanOrEqual": "4.0.19",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "4.1",
              "lessThanOrEqual": "4.1.10",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.0",
              "lessThanOrEqual": "5.0.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-09T14:43:30.429610Z",
          "id": "CVE-2026-32588",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.0.20",
              "matchCriteriaId": "C531A747-3AEF-4CDC-B614-784DC3B6213E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.1.0",
              "versionEndExcluding": "4.1.11",
              "matchCriteriaId": "2CA46AD5-4A57-43F1-889E-7A77FBC3B6A8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.0.0",
              "versionEndExcluding": "5.0.7",
              "matchCriteriaId": "31249BDD-7A3E-4B31-A274-4C7237920C6C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/04/07/9",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}