CVE-2026-64610 PUBLISHED

Apache Kylin: Redis unsafe Java deserialization

Assigner: apache
Reserved: 20.07.2026 Published: 16.10.2026 Updated: 16.10.2026

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Kylin
Versions Default: unaffected
  • affected from 4..0.0 to 5.0.4 (incl.)

Credits

  • Andrew Ridings <ridingsa@gmail.com> finder

References

Problem Types

  • CWE-502 Deserialization of Untrusted Data CWE