CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion
Apache Kylin 4.0.0–5.0.4 lets project admins exhaust computed-column resources through a cache API.
CVE-2026-108837 is a low-severity resource-allocation flaw in Apache Kylin 4.0.0 through 5.0.4. A user who already has project-admin permission can use a cache API to exhaust resources associated with computed columns. Apache recommends upgrading to 5.0.5; no exploitation is reported.
22