Cassandra Project Health

Cassandra

Automated, reproducible metrics for the Apache Cassandra project.

asf_roster: ok git: ok github: ok github_commit_authors: ok github_issues: not_applicable github_profile: ok jira: ok ponymail: ok release: ok release_lines: ok security: ok subproject_releases: not_applicable

This page reports what the public record shows for each commit. It does not judge compliance; the Apache Cassandra project and its maintainers set and interpret their own rules.

CI evidence below is pre-commit — what was posted on each commit's own JIRA ticket before it merged. For post-commit branch CI (the state of each release line's own Jenkins/Butler pipeline right now), see /releases/.

Backfill status

Backfill in progress (partial): 32376 commit(s) processed this run, with 1 CI-evidence lookup(s) and 0 checkstyle-check lookup(s) still pending — picked up automatically on a later run. A pending lookup shows as "not checked yet" below, never as a gap in the commit list.

Facts summary
  • Commits with a named reviewer 93.0% Sep 2026 · n=57
  • Commits referencing a ticket 91.2% Sep 2026 · n=57
  • Commits with CI evidence on JIRA before commit 78.8% Sep 2026 · n=52
  • Commits with a successful checkstyle run 97.8% Sep 2026 · n=46

A plain, neutral share of non-merge commits per month for each column below — how many had a named reviewer, CI evidence before commit, both CI artefacts, or a successful checkstyle run. No thresholds and no judgment are attached to these numbers.

Charts default to the last 3 years.

Faint points mark a month flagged low-n or insufficient data — its statistic (a rate, an HHI, a median) comes from too few underlying events to be reliable on its own. Hover a point for its exact n and flag; the value itself is unchanged.

Commits with a named reviewer

93.0% Sep 2026

JSON · CSV

Commits referencing a ticket

91.2% Sep 2026

JSON · CSV

Commits with CI evidence on JIRA before commit

78.8% Sep 2026

JSON · CSV

Commits with both CI artefacts attached

48.1% Sep 2026

JSON · CSV

Commits with a successful checkstyle run

97.8% Sep 2026

JSON · CSV

Declares "ninja"

descriptive only

A count of commits whose message self-declares "ninja", per month — a project convention, not a documented Cassandra rule, shown for context only.

Commit history

Commit history

Every commit from 2020-06-25 on, one row each, with what the public record shows for review, CI evidence and checkstyle. Export the current view:

Loading commits…

Date Commit Committer Ticket Reviewed by CI evidence CI artefacts on JIRA Checkstyle CHANGES.txt NEWS.txt
References

References

The project's own published guidance this page's facts are drawn from. This project does not interpret these as requirements it enforces — see the note at the top of this page.

0 correction(s) on record in governance_overrides.yaml.

Security

Two independent, external, publicly reproducible feeds — never blended into a single score, and never a substitute for the per-commit evidence collected on this page. See GOVERNANCE.md §11 for full source citations.

OpenSSF Scorecard

github.com/apache/cassandra · Scorecard v5.6.0 · run dated 2026-10-19

Per-check results — read individually, never as one number (RESEARCH.md §6.2)
Check Score Reason
Binary-Artifacts 10.0/10 no binaries found in the repo
Branch-Protection 1.0/10 branch protection is not maximal on development and all release branches

Why: Scorecard's own evidence: force pushes are enabled and no required status checks were found on ‘trunk’ — a directly observable GitHub setting, not an artifact of Cassandra's review process living elsewhere. Unverified: whether this reflects a deliberate ASF Infra/commit-workflow choice rather than an oversight — not confirmed against an ASF Infra source.
CII-Best-Practices 0.0/10 no effort to earn an OpenSSF best practices badge detected
Code-Review 0.0/10 Found 0/30 approved changesets -- score normalized to 0

Why: This check only counts approved GitHub pull-request reviews. Cassandra's actual review process runs through commit-message trailers (“patch by X; reviewed by Y”) and JIRA reviewer fields, both invisible to it — see the reviewer column in the commit history above (verified: RESEARCH.md §6.2, GOVERNANCE.md R1).
Dangerous-Workflow 10.0/10 no dangerous workflow patterns detected
Fuzzing 0.0/10 project is not fuzzed
License 10.0/10 license file detected
Maintained 10.0/10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10

Why: Scorecard's own evidence records “0 issue activity” because GitHub Issues is disabled on apache/cassandra — Cassandra tracks issues in JIRA, not GitHub — not because the project is inactive (verified: RESEARCH.md §6.2).
Packaging n/a packaging workflow not detected

Why: Scorecard found no GitHub/GitLab publishing workflow. Cassandra's release process is the ASF dist/archive pipeline noted under Signed-Releases, not GitHub Packages or Actions-based publishing — same blind spot.
Pinned-Dependencies 0.0/10 dependency not pinned by hash detected -- score normalized to 0
SAST 0.0/10 no SAST tool detected
Security-Policy 10.0/10 security policy file detected
Signed-Releases n/a no releases found

Why: This check only recognizes GitHub Releases, and apache/cassandra publishes none (0 GitHub Releases; DATA-SOURCES.md §5). ASF signs and checksums releases on downloads.apache.org/archive.apache.org instead — verified live: each release carries a .asc GPG signature plus .sha256/.sha512 checksums, and a public KEYS file is published alongside them. Scorecard has no visibility into that channel.
Token-Permissions 0.0/10 detected GitHub workflow tokens with excessive permissions

Scorecard's own aggregate: 4.6/10 (risk-weighted; not used by this project — see the per-check results above).

59 Scorecard runs collected so far: 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-21 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-09-28 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-05 = 4.6; 2026-10-12 = 4.6; 2026-10-12 = 4.6; 2026-10-12 = 4.6; 2026-10-12 = 4.6; 2026-10-12 = 4.6; 2026-10-12 = 4.6; 2026-10-12 = 4.6; 2026-10-12 = 4.6; 2026-10-19 = 4.6.

CVE / advisory history

16 CVE(s) on record for Apache Cassandra (NVD, by CPE cpe:2.3:a:apache:cassandra). Metadata only — no exploit or proof-of-concept content.

  • 2026: 3
  • 2025: 4
  • 2023: 1
  • 2022: 1
  • 2021: 1
  • 2020: 1
  • 2019: 1
  • 2018: 1
  • 2017: 1
  • 2016: 1
  • 2015: 1
CVE Published Severity CVSS Affected versions Fixed in
CVE-2026-27314 2026-04-07 HIGH 8.8 (v3.1) 5.0.0–5.0.7 5.0.7
CVE-2026-27315 2026-04-07 MEDIUM 5.5 (v3.1) 4.0.0–4.0.20 4.0.20
CVE-2026-32588 2026-04-07 MEDIUM 6.5 (v3.1) 4.0.0–4.0.20; 4.1.0–4.1.11; 5.0.0–5.0.7 4.0.20, 4.1.11, 5.0.7
CVE-2025-26467 2025-08-25 HIGH 8.8 (v3.1) 3.0.0–3.0.31; 3.11.0–3.11.18; 4.0.0–4.0.17; 4.1.0–4.1.8; 5.0.0–5.0.3 3.0.31, 3.11.18, 4.0.17, 4.1.8, 5.0.3
CVE-2025-23015 2025-02-04 HIGH 8.8 (v3.1) 3.0.0–3.0.31; 3.1–3.11.18; 4.0.0–4.0.16; 4.1.0–4.1.8; 5.0.0–5.0.3 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3
CVE-2024-27137 2025-02-04 MEDIUM 5.3 (v3.1) 4.0.2–4.0.15; 4.1.0–4.1.8; 5.0.0–5.0.3; 5.0.0–5.0.0 (1 versions) 4.0.15, 4.1.8, 5.0.3
CVE-2025-24860 2025-02-04 MEDIUM 5.4 (v3.1) 4.0.0–4.0.16; 4.1.0–4.1.8; 5.0.0–5.0.3 4.0.16, 4.1.8, 5.0.3
CVE-2023-30601 2023-05-30 HIGH 7.8 (v3.1) 4.0.0–4.0.10; 4.1.0–4.1.2 4.0.10, 4.1.2
CVE-2021-44521 2022-02-11 CRITICAL 9.1 (v3.1) 3.0.0–3.0.26; 3.11.0–3.11.12; 4.0.0–4.0.2 3.0.26, 3.11.12, 4.0.2
CVE-2020-17516 2021-02-03 HIGH 7.5 (v3.1) 2.1.0–2.1.22; 2.2.0–2.2.19; 3.0.0–3.0.23; 3.11.0–3.11.9 unknown
CVE-2020-13946 2020-09-01 MEDIUM 5.9 (v3.1) 0–2.1.22; 2.2.0–2.2.18; 3.0.0–3.0.22; 3.11.0–3.11.8; 4.0.0–4.0.0 (1 versions) 2.1.22, 2.2.18, 3.0.22, 3.11.8
CVE-2019-2684 2019-04-23 MEDIUM 5.9 (v3.1) 2.1.0–2.1.22; 2.2.0–2.2.18; 3.0.0–3.0.22; 3.11.0–3.11.8; 4.0.0–4.0.0 (1 versions) 2.1.22, 2.2.18, 3.0.22, 3.11.8
CVE-2018-8016 2018-06-28 CRITICAL 9.8 (v3.0) 3.8–3.11.1 unknown
CVE-2016-4970 2017-04-13 HIGH 7.5 (v3.1) 3.11.4–3.11.4 (1 versions) unknown
CVE-2016-3427 2016-04-21 CRITICAL 9.8 (v3.1) 2.1.0–2.1.22; 2.2.0–2.2.18; 3.0.0–3.0.22; 3.11.0–3.11.8; 4.0.0–4.0.0 (1 versions) 2.1.22, 2.2.18, 3.0.22, 3.11.8
CVE-2015-0225 2015-04-03 HIGH 7.5 (v2.0) 1.2.0–2.1.3 (38 versions) unknown