« Volver al listado

CVE-2026-32588

Estado: AnalizadaMedia (6.5)—

Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes. Users are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Cassandra

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-32588",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-32588",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-09T14:43:30.429610Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Cassandra",
          "versions": [
            {
              "status": "affected",
              "version": "4.0",
              "versionType": "semver",
              "lessThanOrEqual": "4.0.19"
            },
            {
              "status": "affected",
              "version": "4.1",
              "versionType": "semver",
              "lessThanOrEqual": "4.1.10"
            },
            {
              "status": "affected",
              "version": "5.0",
              "versionType": "semver",
              "lessThanOrEqual": "5.0.6"
            }
          ],
          "packageName": "org.apache.cassandra:cassandra-all",
          "collectionURL": "https://repo.maven.apache.org/maven2/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-07T17:16:28.297",
  "references": [
    {
      "url": "https://lists.apache.org/thread/2tnwjdnss378glxrsmnlzz3k53ftphrc",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/04/07/9",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies via repeated password changes.\nUsers are recommended to upgrade to version 4.0.20, 4.1.11, 5.0.7, which fixes this issue."
    }
  ],
  "lastModified": "2026-06-17T10:36:03.557",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C531A747-3AEF-4CDC-B614-784DC3B6213E",
              "versionEndExcluding": "4.0.20",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CA46AD5-4A57-43F1-889E-7A77FBC3B6A8",
              "versionEndExcluding": "4.1.11",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:apache:cassandra:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31249BDD-7A3E-4B31-A274-4C7237920C6C",
              "versionEndExcluding": "5.0.7",
              "versionStartIncluding": "5.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}