products / cassandra
Apache Cassandra
Cassandra is a distributed wide-column store from the ASF. NVD uses apache:cassandra. The NVD keyword is the full phrase Apache Cassandra to avoid unrelated "Cassandra" text matches.
api usage
Querying Cassandra
product slug
cassandraversion format
3.11.10, 4.0.3bash
curl "https://api.attestd.io/v1/check?product=cassandra&version=3.11.10" \
-H "Authorization: Bearer $ATTESTD_KEY"Cassandra 3.11.10 is affected by CVE-2021-44521 (RCE via user-defined functions when enabled) plus later critical CVEs. The response aggregates all applicable CVEs for this version.
json
{
"product": "cassandra",
"version": "3.11.10",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"remote_code_execution",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": true,
"patch_available": true,
"fixed_version": "3.11.18",
"confidence": 0.5,
"cve_ids": [
"CVE-2021-44521",
"CVE-2025-23015",
"CVE-2025-26467"
],
"cves": null,
"max_epss": 0.55006,
"last_updated": "2026-07-13T05:13:11.015081Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}safe version
Cassandra 3.11.18 clears the CVEs returned for 3.11.10, including CVE-2021-44521.
bash
curl "https://api.attestd.io/v1/check?product=cassandra&version=3.11.18" \
-H "Authorization: Bearer $ATTESTD_KEY"notable cves
CVE history
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2021-44521 | Remote code execution when UDF execution is enabled. | 3.x, 4.0 (see NVD) | 10.0 |
CVE-2020-17516 | Inter-node / internode encryption validation issue. | 3.0, 4.0 | 7.5 |
CVE-2019-13922 | Privilege escalation via JMX/reaper integrations. | 3.x | 8.1 |
CVE-2025-26511 | Cassandra security update (verify NVD for ranges). | see NVD | 6.0 |
CVE-2020-36939 | Information disclosure in configuration handling. | 3.11 | 5.3 |
related