Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.4
Cassandra packages risk exploitation before update
published 5 days ago
Summary
The Cassandra, Cassandra‑FIPS, and Cassandra‑Reaper-FIPS software versions listed are vulnerable and could be abused by attackers. This weakness is fixed in newer releases, so continuing to run the old versions puts your data and services at risk. Upgrade to the latest versions as soon as possible to eliminate the problem.
What to do
- Update cleanstart cassandra-reaper-fips to version 3.8.0-r3.
- Update cleanstart cassandra to version 5.0.6-r1.
- Update cleanstart cassandra-fips to version 5.0.6-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | cassandra-reaper-fips |
< 3.8.0-r3 Fix: upgrade to 3.8.0-r3
|
| CleanStart | cleanstart | cassandra |
< 5.0.6-r1 Fix: upgrade to 5.0.6-r1
|
| CleanStart | cleanstart | cassandra-fips |
< 5.0.6-r1 Fix: upgrade to 5.0.6-r1
|
Original advisory text
Security fix for GHSA-25qh-j22f-pwp8 applied in: cassandra-reaper-fips 3.8.0-r3, cassandra 5.0.6-r1, cassandra-fips 5.0.6-r1
GHSA-25qh-j22f-pwp8 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-EI49719 · OSV
Track software like this
Free during beta