What is GHSA-qffm-gf3j-6mvg?

GHSA-qffm-gf3j-6mvg is a security advisory published by GitHub Security Advisories with Low severity. Apache Cassandra has an authenticated DoS over CQL

Which CVE IDs does GHSA-qffm-gf3j-6mvg cover?

GHSA-qffm-gf3j-6mvg covers the following CVE IDs: CVE-2026-32588. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-qffm-gf3j-6mvg?

GHSA-qffm-gf3j-6mvg affects 3 products, including: maven/org.apache.cassandra:cassandra-all:\u003e= 4.0, \u003c 4.0.20; maven/org.apache.cassandra:cassandra-all:\u003e= 4.1, \u003c 4.1.11; maven/org.apache.cassandra:cassandra-all:\u003e= 5.0, \u003c 5.0.7.

GHSA-qffm-gf3j-6mvgLow

Apache Cassandra has an authenticated DoS over CQL

Vendor

GitHub Security Advisories

Published

April 7, 2026

Last Modified

April 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-32588 →

📋 Description

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.

🎯 Affected products3

maven/org.apache.cassandra:cassandra-all:>= 4.0, < 4.0.20
maven/org.apache.cassandra:cassandra-all:>= 4.1, < 4.1.11
maven/org.apache.cassandra:cassandra-all:>= 5.0, < 5.0.7

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-32588
https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc
http://www.openwall.com/lists/oss-security/2026/04/07/9
https://github.com/advisories/GHSA-qffm-gf3j-6mvg