Apache Cassandra: architecture, versions and installation

Updated November 2026

Apache Cassandra is a distributed database that spreads data over many servers with no single master, so it keeps accepting reads and writes when machines or whole datacenters fail. As of November 2026 the latest release is Cassandra 5.0.9 (August 7, 2026), and the 4.1 and 4.0 lines are still maintained.

What Cassandra is

The documentation describes Cassandra as a partitioned wide-column store with eventually consistent semantics, combining the distribution ideas of Amazon's Dynamo with the data model of Google's Bigtable. You talk to it with CQL (Cassandra Query Language), which looks like SQL: keyspaces contain tables, tables have typed columns, and you SELECT and INSERT.

The difference from a relational database is in what it refuses to do. Cassandra does not do joins or other operations that need coordination across partitions. You design one table per query you need, with a primary key made of a partition key (which decides where a row lives) and optional clustering columns (which sort rows inside the partition). In return, adding servers adds capacity in a nearly straight line.

Typical uses

It is a poor fit for ad hoc queries across many tables, strict multi-row transactions, or small data sets that fit comfortably in one PostgreSQL server.

Architecture in plain words

The token ring
Cassandra hashes each partition key to a number (a token) and places the nodes on a ring of tokens. A row belongs to the node whose range covers its token. With virtual nodes (vnodes) each physical node holds many small ranges, which spreads load more evenly.
Replication
Each keyspace sets how many copies to keep, per datacenter. The documentation recommends NetworkTopologyStrategy for production, even with one datacenter.
Gossip
Nodes exchange state with their peers every second, so each node knows which others are up. New nodes contact seed nodes to join.
Tunable consistency
Each query chooses how many replicas must answer: ONE, QUORUM (a majority: n/2 + 1), LOCAL_QUORUM (a majority in the local datacenter) or ALL.
Storage engine
A write goes to an append-only commit log on disk (for crash recovery) and to an in-memory memtable. Full memtables are flushed to immutable, sorted SSTable files, and background compaction merges SSTables over time.

The consistency arithmetic is worth learning. With replication factor RF = 3, QUORUM means 3 ÷ 2 + 1 = 2 replicas (integer division). If writes and reads both use QUORUM, then W + R = 2 + 2 = 4, which is greater than RF = 3, so every read overlaps at least one replica that saw the latest write. You can lose one of the three replicas and still read and write. With ONE for both, W + R = 2, which is not greater than 3, so a read may return stale data.

What 5.0 added

Cassandra 5.0's new features include Storage Attached Indexes (SAI, flexible secondary indexes), trie-based memtables and SSTables, a vector data type with similarity functions, the Unified Compaction Strategy, Dynamic Data Masking, a CIDR authorizer, more guardrails, and JDK 17 support.

Current versions

The download page lists three maintained lines, as of November 2026. Instead of calendar dates, each line is maintained until a later major release ships:

Maintained Apache Cassandra releases, as of November 2026
LineLatest releaseReleasedMaintained until
5.05.0.9August 7, 2026the 8.0 release
4.14.1.12August 7, 2026the 7.0 release
4.04.0.21August 7, 2026the 6.0 release

The next major version is 6.0. A 6.0 pre-release (6.0-alpha2) is on the Apache download server for testing; it is not a production release. When 6.0 becomes generally available, 4.0 leaves maintenance, so 4.0 users should plan a move to 4.1 or 5.0. Older lines (3.11, 3.0 and earlier) are unmaintained; the project may still apply CVE fixes to them case by case.

Install and try it

Cassandra 5.0 needs Java 11 or Java 17, and cqlsh needs Python 3.8 to 3.13. Note that Debian 13 ships OpenJDK 21 and 25 but not 17; Ubuntu 24.04 (openjdk-17-jre-headless) and RHEL 9 (java-17-openjdk-headless) do have Java 17. The container image avoids the question because it bundles its own Java.

Docker (quickest)

docker run --name cass1 -d cassandra:5.0
# wait about a minute for startup, then:
docker exec -it cass1 nodetool status
docker exec -it cass1 cqlsh

Debian and Ubuntu packages

The project runs its own APT repository. The series name is the major version without the dot plus "x": 50x for 5.0 (older: 41x, 40x).

sudo install -d -m 0755 /etc/apt/keyrings
sudo curl -o /etc/apt/keyrings/apache-cassandra.asc https://downloads.apache.org/cassandra/KEYS
echo "deb [signed-by=/etc/apt/keyrings/apache-cassandra.asc] https://debian.cassandra.apache.org 50x main" | sudo tee -a /etc/apt/sources.list.d/cassandra.sources.list
sudo apt-get update
sudo apt-get install cassandra

RHEL, Rocky, Alma and Fedora packages

Create /etc/yum.repos.d/cassandra.repo as root:

[cassandra]
name=Apache Cassandra
baseurl=https://redhat.cassandra.apache.org/50x/
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://downloads.apache.org/cassandra/KEYS
sudo dnf install cassandra

The download page warns that the RPMs are not yet thoroughly tested on all platforms. (Some older documentation pages still show a 42x path; use 50x for 5.0.)

Tarball

curl -OL https://downloads.apache.org/cassandra/5.0.9/apache-cassandra-5.0.9-bin.tar.gz
curl -OL https://downloads.apache.org/cassandra/5.0.9/apache-cassandra-5.0.9-bin.tar.gz.sha512
sha512sum apache-cassandra-5.0.9-bin.tar.gz   # compare with the .sha512 file
tar -xzf apache-cassandra-5.0.9-bin.tar.gz
cd apache-cassandra-5.0.9 && bin/cassandra

Check that it works

nodetool status should show your node with status UN (Up/Normal) under a heading such as Datacenter: datacenter1. Then, in cqlsh, use that datacenter name:

CREATE KEYSPACE demo
  WITH replication = {'class': 'NetworkTopologyStrategy', 'datacenter1': 1};
CREATE TABLE demo.readings (
  sensor_id text, ts timestamp, value double,
  PRIMARY KEY ((sensor_id), ts)
) WITH CLUSTERING ORDER BY (ts DESC);
INSERT INTO demo.readings (sensor_id, ts, value) VALUES ('s1', toTimestamp(now()), 21.5);
SELECT * FROM demo.readings WHERE sensor_id = 's1' LIMIT 10;

Here sensor_id is the partition key (all readings of one sensor live together) and ts sorts them newest first. A replication factor of 1 is only for a single test node; production clusters normally use 3 per datacenter.

Security and upgrades

Lock it down. The security documentation warns that an out-of-the-box installation presents a large attack surface. Client authentication alone is not enough: anyone who can reach the internode or JMX ports can still tamper with the cluster. Enable authentication and authorization, use TLS for client and internode traffic, and keep the CQL port (9042 by default), internode ports and JMX on private networks only.

Sources