Database
Apache Cassandra: supported versions and open vulnerabilities today
Apache Cassandra 5.0, 4.1 and 4.0 are supported; 3.11 reached end of life on Sep 5, 2024; the latest release is 5.0.9. 1 high or critical advisory for Apache Cassandra was published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 5.0.9
- GitHub stars
- 10.1k
- Licence
- Apache-2.0
- OpenSSF Scorecard
- 4.8 / 10
Supported versions
Security advisories
3 advisories published in the last 12 months, 1 of them high or critical. 12 in total since records began. Checked packages: org.apache.cassandra:cassandra-all.
Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator
Fixed in 5.0.7.
EPSS: top 75%
All org.apache.cassandra:cassandra-all advisories on OSV.dev
Maintenance and supply chain
OpenSSF Scorecard 4.8 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 0 issue updates found in the last 90 days.
Weakest checks
- Little code review (Code-Review 0/10)
- Over-privileged CI tokens (Token-Permissions 0/10)
- Unpinned build dependencies (Pinned-Dependencies 0/10)
Alternatives
MongoDB
Document-oriented NoSQL database with flexible schema
Strengths
- Flexible schema for evolving data models
- Rich query language with aggregation
Trade-offs
- No ACID transactions across documents (older versions)
- Higher memory usage
DynamoDB
AWS-managed serverless NoSQL database
Strengths
- Fully managed serverless operation
- Single-digit millisecond latency
Trade-offs
- AWS vendor lock-in
- Limited query capabilities (requires indexes)
Couchbase
Document and key-value NoSQL database with caching
Strengths
- Built-in caching layer
- SQL-like query language (N1QL)
Trade-offs
- Smaller community than MongoDB
- Enterprise features require licensing
ScyllaDB
Cassandra-compatible NoSQL database written in C++ for performance
Strengths
- 10x lower latency than Cassandra
- Drop-in Cassandra replacement (CQL compatible)
Trade-offs
- Smaller community than Cassandra
- Fewer third-party tools and integrations
Docs and release notes
Check Apache Cassandra in your own stack
This page checks Apache Cassandra in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.