Apache Cassandra (Netty): Schwachstelle ermöglicht Denial of Service
WID-SEC-2026-0254 · first 29.01.2026 · updated 14.09.2026 · CVSS 5,5
What it is about
Cassandra ist ein einfaches, verteiltes Datenbankverwaltungssystem für sehr große strukturierte Datenbanken. Ein lokaler Angreifer kann eine Schwachstelle in Apache Cassandra ausnutzen, um einen Denial of Service Angriff durchzuführen.
Under what conditions?
Only with access to the device or an account on it. Often the second step after a phishing email.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Denial of Service Angriff durchzuführen
Am I affected?
Affected according to the BSI:
- IBM License Metric Tool
- Apache Cassandra <4.0.20
- Apache Cassandra <4.1.11
- Apache Cassandra <5.0.7
- Apache Cassandra <5.1
- IBM Cognos Analytics <12.1.3 FP2
- IBM Cognos Analytics <12.0.4 FP3
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Apache Cassandra 4.0.20
- Apache Cassandra 4.1.11
- Apache Cassandra 5.0.7
- Apache Cassandra 5.1
- IBM Cognos Analytics 12.1.3 FP2
- IBM Cognos Analytics 12.0.4 FP3
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Apache Mailing List vom 2026-01-28 lists.apache.org
- Cassandra issue vom 2026-01-28 issues.apache.org
- Commit Auf GitHub vom 2026-01-28 github.com
- PoC vom 2026-01-28 github.com
- IBM Security Bulletin 7270885 vom 2026-04-27 www.ibm.com
- IBM Security Bulletin 7287209 vom 2026-09-11 www.ibm.com
CVE: CVE-2024-47535
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.