CVE-2026-108837 PUBLISHED

Apache Kylin: Potential computed-column resource exhaustion

Assigner: apache
Reserved: 11.10.2026 Published: 19.10.2026 Updated: 19.10.2026

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion.

This issue affects Apache Kylin: from 4.0.0 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Kylin
Versions Default: unaffected
  • affected from 4.0.0 to 5.0.4 (incl.)

Credits

  • HRsGIT (https://github.com/HRsGIT) finder

References

Problem Types

  • CWE-770 Allocation of resources without limits or throttling CWE