The management-api-for-apache-cassandra-5.0 package is impacted by multiple security vulnerabilities, notably CVE-2026-33870 and CVE-2026-33871, which involve request smuggling through incorrect parsing of HTTP/1.1 chunked transfer encoding extension values and denial of service via HTTP/2 CONTINUATION frame flood, respectively. These issues have been fixed in later releases, with patches available from Red Hat as part of updates to related components such as netty-codec-http and netty-codec-http2. The vulnerabilities are rated as high severity and affect versions prior to 0.1.118-r2. Vendor advisories from Red Hat provide detailed remediation instructions and confirm the availability of fixes.

These vulnerabilities could allow an attacker to perform HTTP request smuggling attacks or cause denial of service conditions by flooding HTTP/2 CONTINUATION frames, potentially disrupting service availability or bypassing security controls. The impact is considered high due to the nature of these attacks affecting the management API for Apache Cassandra 5.0. No known exploits in the wild have been reported at this time.

A patch is available for the affected versions of the management-api-for-apache-cassandra-5.0 package. Users should apply the official updates provided by Red Hat and other vendors as referenced in the advisories. Before applying updates, it is recommended to back up existing installations, including applications, configuration files, and databases. No additional mitigation steps are specified beyond applying the official patches.