Authenticated users can repeatedly change their passwords, causing Cassandra to perform costly hashing for each change. This repeated computation increases query latencies and can degrade overall cluster performance, ultimately leading to a denial of service for legitimate users. The vulnerability reflects uncontrolled resource consumption and unbounded allocation of resources.

Apache Cassandra releases 4.0, 4.1, and 5.0 are vulnerable. The issue is fixed in releases 4.0.20, 4.1.11, and 5.0.7, so upgrading to those versions removes the flaw.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests that exploitation is unlikely in the wild. Exploitation requires valid credentials or an already compromised account; once authenticated, an attacker can submit many password change requests to inflate cluster latency. The vulnerability is not currently listed in the CISA KEV catalog, but the combination of moderate severity and authenticated access warrants timely remediation or mitigation.